All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Toke Høiland-Jørgensen" <toke@redhat.com>
To: David Miller <davem@davemloft.net>
Cc: netdev@vger.kernel.org, cake@lists.bufferbloat.net
Subject: [PATCH net 2/2] sch_cake: Make sure we can write the IP header before changing DSCP bits
Date: Thu, 04 Apr 2019 15:01:33 +0200	[thread overview]
Message-ID: <155438289374.18760.4278774647362746152.stgit@alrua-x1> (raw)
In-Reply-To: <155438289359.18760.18027832614176337074.stgit@alrua-x1>

There is not actually any guarantee that the IP headers are valid before we
access the DSCP bits of the packets. Fix this using the same approach taken
in sch_dsmark.

Reported-by: Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>
Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
---
 net/sched/sch_cake.c |   11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c
index a3b55e18df04..259d97bc2abd 100644
--- a/net/sched/sch_cake.c
+++ b/net/sched/sch_cake.c
@@ -1517,16 +1517,27 @@ static unsigned int cake_drop(struct Qdisc *sch, struct sk_buff **to_free)
 
 static u8 cake_handle_diffserv(struct sk_buff *skb, u16 wash)
 {
+	int wlen = skb_network_offset(skb);
 	u8 dscp;
 
 	switch (tc_skb_protocol(skb)) {
 	case htons(ETH_P_IP):
+		wlen += sizeof(struct iphdr);
+		if (!pskb_may_pull(skb, wlen) ||
+		    skb_try_make_writable(skb, wlen))
+			return 0;
+
 		dscp = ipv4_get_dsfield(ip_hdr(skb)) >> 2;
 		if (wash && dscp)
 			ipv4_change_dsfield(ip_hdr(skb), INET_ECN_MASK, 0);
 		return dscp;
 
 	case htons(ETH_P_IPV6):
+		wlen += sizeof(struct ipv6hdr);
+		if (!pskb_may_pull(skb, wlen) ||
+		    skb_try_make_writable(skb, wlen))
+			return 0;
+
 		dscp = ipv6_get_dsfield(ipv6_hdr(skb)) >> 2;
 		if (wash && dscp)
 			ipv6_change_dsfield(ipv6_hdr(skb), INET_ECN_MASK, 0);


  parent reply	other threads:[~2019-04-04 13:01 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-04-04 13:01 [PATCH net 0/2] sched: A few small fixes for sch_cake Toke Høiland-Jørgensen
2019-04-04 13:01 ` [PATCH net 1/2] sch_cake: Use tc_skb_protocol() helper for getting packet protocol Toke Høiland-Jørgensen
2019-04-04 13:01 ` Toke Høiland-Jørgensen [this message]
2019-04-04 19:35   ` [PATCH net 2/2] sch_cake: Make sure we can write the IP header before changing DSCP bits Stephen Hemminger
2019-04-04 20:44     ` Toke Høiland-Jørgensen
2019-04-04 21:40       ` Stephen Hemminger
2019-04-04 21:55         ` Toke Høiland-Jørgensen
2019-04-04 17:56 ` [PATCH net 0/2] sched: A few small fixes for sch_cake David Miller

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=155438289374.18760.4278774647362746152.stgit@alrua-x1 \
    --to=toke@redhat.com \
    --cc=cake@lists.bufferbloat.net \
    --cc=davem@davemloft.net \
    --cc=netdev@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.