Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2614fa59 authored by Herbert Xu's avatar Herbert Xu Committed by David S. Miller
Browse files

[IPCOMP]: Fetch nexthdr before ipch is destroyed 



When I moved the nexthdr setting out of IPComp I accidently moved
the reading of ipch->nexthdr after the decompression.  Unfortunately
this means that we'd be reading from a stale ipch pointer which
doesn't work very well.

This patch moves the reading up so that we get the correct nexthdr
value.

Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 936f6f8e

net/ipv4/ipcomp.c

+4 −1
Original line number Diff line number Diff line
@@ -74,6 +74,7 @@ out: 


static int ipcomp_input(struct xfrm_state *x, struct sk_buff *skb)

{

	int nexthdr;

	int err = -ENOMEM;

	struct ip_comp_hdr *ipch;
@@ -84,13 +85,15 @@ static int ipcomp_input(struct xfrm_state *x, struct sk_buff *skb) 


	/* Remove ipcomp header and decompress original payload */

	ipch = (void *)skb->data;

	nexthdr = ipch->nexthdr;



	skb->transport_header = skb->network_header + sizeof(*ipch);

	__skb_pull(skb, sizeof(*ipch));

	err = ipcomp_decompress(x, skb);

	if (err)

		goto out;



	err = ipch->nexthdr;

	err = nexthdr;



out:

	return err;

net/ipv6/ipcomp6.c

+4 −1
Original line number Diff line number Diff line
@@ -64,6 +64,7 @@ static LIST_HEAD(ipcomp6_tfms_list); 


static int ipcomp6_input(struct xfrm_state *x, struct sk_buff *skb)

{

	int nexthdr;

	int err = -ENOMEM;

	struct ip_comp_hdr *ipch;

	int plen, dlen;
@@ -79,6 +80,8 @@ static int ipcomp6_input(struct xfrm_state *x, struct sk_buff *skb) 


	/* Remove ipcomp header and decompress original payload */

	ipch = (void *)skb->data;

	nexthdr = ipch->nexthdr;



	skb->transport_header = skb->network_header + sizeof(*ipch);

	__skb_pull(skb, sizeof(*ipch));
@@ -108,7 +111,7 @@ static int ipcomp6_input(struct xfrm_state *x, struct sk_buff *skb) 
	skb->truesize += dlen - plen;

	__skb_put(skb, dlen - plen);

	skb_copy_to_linear_data(skb, scratch, dlen);

	err = ipch->nexthdr;

	err = nexthdr;



out_put_cpu:

	put_cpu();