Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1b05c4b5 authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller
Browse files

ipv6: raw: fix icmpv6_filter() 



icmpv6_filter() should not modify its input, or else its caller
would need to recompute ipv6_hdr() if skb->head is reallocated.

Use skb_header_pointer() instead of pskb_may_pull() and
change the prototype to make clear both sk and skb are const.

Also, if icmpv6 header cannot be found, do not deliver the packet,
as we do in IPv4.

Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 41e26856

net/ipv6/raw.c

+10 −11
Original line number Original line Diff line number Diff line
@@ -107,21 +107,20 @@ static struct sock *__raw_v6_lookup(struct net *net, struct sock *sk, 
 *	0 - deliver

 *	0 - deliver

 *	1 - block

 *	1 - block

 */

 */

static __inline__ int icmpv6_filter(struct sock *sk, struct sk_buff *skb)

static int icmpv6_filter(const struct sock *sk, const struct sk_buff *skb)

{

{

	struct icmp6hdr *icmph;

	struct icmp6hdr *_hdr;

	struct raw6_sock *rp = raw6_sk(sk);

	const struct icmp6hdr *hdr;



	if (pskb_may_pull(skb, sizeof(struct icmp6hdr))) {

		__u32 *data = &rp->filter.data[0];

		int bit_nr;





		icmph = (struct icmp6hdr *) skb->data;

	hdr = skb_header_pointer(skb, skb_transport_offset(skb),

		bit_nr = icmph->icmp6_type;

				 sizeof(_hdr), &_hdr);

	if (hdr) {

		const __u32 *data = &raw6_sk(sk)->filter.data[0];

		unsigned int type = hdr->icmp6_type;





		return (data[bit_nr >> 5] & (1 << (bit_nr & 31))) != 0;

		return (data[type >> 5] & (1U << (type & 31))) != 0;

	}

	}

	return 0;

	return 1;

}

}





#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)

#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)