Messages in this thread Patch in this message | | | From | Andrea Mayer <> | Subject | [net-next, 1/3] seg6: verify srh pointer in get_srh() | Date | Wed, 13 Nov 2019 20:29:10 +0100 |
| |
pskb_may_pull may change pointers in header. For this reason, it is mandatory to reload any pointer that points into skb header.
Signed-off-by: Andrea Mayer <andrea.mayer@uniroma2.it> --- net/ipv6/seg6_local.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/net/ipv6/seg6_local.c b/net/ipv6/seg6_local.c index 9d4f75e0d33a..e187dec2eed1 100644 --- a/net/ipv6/seg6_local.c +++ b/net/ipv6/seg6_local.c @@ -75,12 +75,16 @@ static struct ipv6_sr_hdr *get_srh(struct sk_buff *skb) return NULL; srh = (struct ipv6_sr_hdr *)(skb->data + srhoff); - len = (srh->hdrlen + 1) << 3; if (!pskb_may_pull(skb, srhoff + len)) return NULL; + /* note that pskb_may_pull may change pointers in header; + * for this reason it is necessary to reload them when needed. + */ + srh = (struct ipv6_sr_hdr *)(skb->data + srhoff); + if (!seg6_validate_srh(srh, len)) return NULL; -- 2.20.1
| |