lkml.org 
[lkml]   [2016]   [May]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 03/67] ipvs: handle ip_vs_fill_iph_skb_off failure
    Date
    4.4-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Arnd Bergmann <arnd@arndb.de>

    commit 3f20efba41916ee17ce82f0fdd02581ada2872b2 upstream.

    ip_vs_fill_iph_skb_off() may not find an IP header, and gcc has
    determined that ip_vs_sip_fill_param() then incorrectly accesses
    the protocol fields:

    net/netfilter/ipvs/ip_vs_pe_sip.c: In function 'ip_vs_sip_fill_param':
    net/netfilter/ipvs/ip_vs_pe_sip.c:76:5: error: 'iph.protocol' may be used uninitialized in this function [-Werror=maybe-uninitialized]
    if (iph.protocol != IPPROTO_UDP)
    ^
    net/netfilter/ipvs/ip_vs_pe_sip.c:81:10: error: 'iph.len' may be used uninitialized in this function [-Werror=maybe-uninitialized]
    dataoff = iph.len + sizeof(struct udphdr);
    ^

    This adds a check for the ip_vs_fill_iph_skb_off() return code
    before looking at the ip header data returned from it.

    Signed-off-by: Arnd Bergmann <arnd@arndb.de>
    Fixes: b0e010c527de ("ipvs: replace ip_vs_fill_ip4hdr with ip_vs_fill_iph_skb_off")
    Acked-by: Julian Anastasov <ja@ssi.bg>
    Signed-off-by: Simon Horman <horms@verge.net.au>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    net/netfilter/ipvs/ip_vs_pe_sip.c | 4 ++--
    1 file changed, 2 insertions(+), 2 deletions(-)

    --- a/net/netfilter/ipvs/ip_vs_pe_sip.c
    +++ b/net/netfilter/ipvs/ip_vs_pe_sip.c
    @@ -70,10 +70,10 @@ ip_vs_sip_fill_param(struct ip_vs_conn_p
    const char *dptr;
    int retc;

    - ip_vs_fill_iph_skb(p->af, skb, false, &iph);
    + retc = ip_vs_fill_iph_skb(p->af, skb, false, &iph);

    /* Only useful with UDP */
    - if (iph.protocol != IPPROTO_UDP)
    + if (!retc || iph.protocol != IPPROTO_UDP)
    return -EINVAL;
    /* todo: IPv6 fragments:
    * I think this only should be done for the first fragment. /HS

    \
     
     \ /
      Last update: 2016-05-09 10:01    [W:4.755 / U:0.288 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site