Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
tjh.dev
kernel
os
linux
ah: reload pointers to skb data after calling skb_cow_data()
skb_cow_data() may allocate a new data buffer, so pointers on
skb should be set after this function.
Bug was introduced by commit dff3bb06 ("ah4: convert to ahash")
and 8631e9bd ("ah6: convert to ahash").
Signed-off-by: Wang Xuefu <xuefu.wang@6wind.com>
Acked-by: Krzysztof Witek <krzysztof.witek@6wind.com>
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
authored by Dang Hongwu and committed by David S. Miller 4b0ef1f2 e44f3911
+4
-3
net/ipv4/ah4.c
+4
-3
net/ipv4/ah4.c
···
314
314
315
315
skb->ip_summed = CHECKSUM_NONE;
316
316
317
-
ah = (struct ip_auth_hdr *)skb->data;
318
-
iph = ip_hdr(skb);
319
-
ihl = ip_hdrlen(skb);
320
317
321
318
if ((err = skb_cow_data(skb, 0, &trailer)) < 0)
322
319
goto out;
323
320
nfrags = err;
321
+
322
+
ah = (struct ip_auth_hdr *)skb->data;
323
+
iph = ip_hdr(skb);
324
+
ihl = ip_hdrlen(skb);
324
325
325
326
work_iph = ah_alloc_tmp(ahash, nfrags, ihl + ahp->icv_trunc_len);
326
327
if (!work_iph)
+5
-3
net/ipv6/ah6.c
+5
-3
net/ipv6/ah6.c
···
538
538
if (!pskb_may_pull(skb, ah_hlen))
539
539
goto out;
540
540
541
-
ip6h = ipv6_hdr(skb);
542
-
543
-
skb_push(skb, hdr_len);
544
541
545
542
if ((err = skb_cow_data(skb, 0, &trailer)) < 0)
546
543
goto out;
547
544
nfrags = err;
545
+
546
+
ah = (struct ip_auth_hdr *)skb->data;
547
+
ip6h = ipv6_hdr(skb);
548
+
549
+
skb_push(skb, hdr_len);
548
550
549
551
work_iph = ah_alloc_tmp(ahash, nfrags, hdr_len + ahp->icv_trunc_len);
550
552
if (!work_iph)