lkml.org 
[lkml]   [2012]   [Jan]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[54/90] ah: Read nexthdr value before overwriting it in ahash input callback.
    3.0-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Nick Bowler <nbowler@elliptictech.com>

    commit b7ea81a58adc123a4e980cb0eff9eb5c144b5dc7 upstream.

    The AH4/6 ahash input callbacks read out the nexthdr field from the AH
    header *after* they overwrite that header. This is obviously not going
    to end well. Fix it up.

    Signed-off-by: Nick Bowler <nbowler@elliptictech.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    net/ipv4/ah4.c | 4 ++--
    net/ipv6/ah6.c | 4 ++--
    2 files changed, 4 insertions(+), 4 deletions(-)

    --- a/net/ipv4/ah4.c
    +++ b/net/ipv4/ah4.c
    @@ -262,12 +262,12 @@ static void ah_input_done(struct crypto_
    if (err)
    goto out;

    + err = ah->nexthdr;
    +
    skb->network_header += ah_hlen;
    memcpy(skb_network_header(skb), work_iph, ihl);
    __skb_pull(skb, ah_hlen + ihl);
    skb_set_transport_header(skb, -ihl);
    -
    - err = ah->nexthdr;
    out:
    kfree(AH_SKB_CB(skb)->tmp);
    xfrm_input_resume(skb, err);
    --- a/net/ipv6/ah6.c
    +++ b/net/ipv6/ah6.c
    @@ -464,12 +464,12 @@ static void ah6_input_done(struct crypto
    if (err)
    goto out;

    + err = ah->nexthdr;
    +
    skb->network_header += ah_hlen;
    memcpy(skb_network_header(skb), work_iph, hdr_len);
    __skb_pull(skb, ah_hlen + hdr_len);
    skb_set_transport_header(skb, -hdr_len);
    -
    - err = ah->nexthdr;
    out:
    kfree(AH_SKB_CB(skb)->tmp);
    xfrm_input_resume(skb, err);



    \
     
     \ /
      Last update: 2012-01-24 01:07    [W:0.024 / U:0.292 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site