raspi/linux
1
0
Fork 1
mirror of https://github.com/raspberrypi/linux.git synced 2025-12-08 02:49:48 +00:00
Code Issues Projects Releases Wiki Activity

esp4: Fix udpencap for local TCP packets.

Browse Source 
Locally generated TCP packets are usually cloned, so we
do skb_cow_data() on this packets. After that we need to
reload the pointer to the esp header. On udpencap this
header has an offset to skb_transport_header, so take this
offset into account.

Fixes: 67d349ed60 ("net/esp4: Fix invalid esph pointer crash")
Fixes: fca11ebde3 ("esp4: Reorganize esp_output")
Reported-by: Don Bowman <db@donbowman.ca>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
This commit is contained in:
Steffen Klassert
2017-05-03 08:44:27 +02:00
parent f411af6822
commit 0e78a87306
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
net/ipv4/esp4.c
View File

@@ -248,6 +248,7 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *
u8 *tail; u8 *tail;
u8 *vaddr; u8 *vaddr;
int nfrags; int nfrags;
int esph_offset;
struct page *page; struct page *page;
struct sk_buff *trailer; struct sk_buff *trailer;
int tailen = esp->tailen; int tailen = esp->tailen;
@@ -313,11 +314,13 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *
} }
cow: cow:
esph_offset = (unsigned char *)esp->esph - skb_transport_header(skb);
nfrags = skb_cow_data(skb, tailen, &trailer); nfrags = skb_cow_data(skb, tailen, &trailer);
if (nfrags < 0) if (nfrags < 0)
goto out; goto out;
tail = skb_tail_pointer(trailer); tail = skb_tail_pointer(trailer);
esp->esph = ip_esp_hdr(skb); esp->esph = (struct ip_esp_hdr *)(skb_transport_header(skb) + esph_offset);
skip_cow: skip_cow:
esp_output_fill_trailer(tail, esp->tfclen, esp->plen, esp->proto); esp_output_fill_trailer(tail, esp->tfclen, esp->plen, esp->proto);