* bridge: Fix IGMP3 report parsing
@ 2010-04-08 1:26 Herbert Xu
2010-04-08 3:52 ` David Miller
0 siblings, 1 reply; 4+ messages in thread
From: Herbert Xu @ 2010-04-08 1:26 UTC (permalink / raw)
To: David S. Miller, netdev; +Cc: Banyeer
Hi:
bridge: Fix IGMP3 report parsing
The IGMP3 report parsing is looking at the wrong address for
group records. This patch fixes it.
Reported-by: Banyeer <banyeer@yahoo.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 6980625..5f0acfd 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -719,11 +719,11 @@ static int br_multicast_igmp3_report(struct net_bridge *br,
len = sizeof(*ih);
for (i = 0; i < num; i++) {
+ grec = (void *)(skb->data + len);
len += sizeof(*grec);
if (!pskb_may_pull(skb, len))
return -EINVAL;
- grec = (void *)(skb->data + len);
group = grec->grec_mca;
type = grec->grec_type;
Thanks,
--
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: bridge: Fix IGMP3 report parsing
2010-04-08 1:26 bridge: Fix IGMP3 report parsing Herbert Xu
@ 2010-04-08 3:52 ` David Miller
2010-04-08 4:07 ` Herbert Xu
0 siblings, 1 reply; 4+ messages in thread
From: David Miller @ 2010-04-08 3:52 UTC (permalink / raw)
To: herbert; +Cc: netdev, banyeer
From: Herbert Xu <herbert@gondor.apana.org.au>
Date: Thu, 8 Apr 2010 09:26:34 +0800
> Hi:
>
> bridge: Fix IGMP3 report parsing
>
> The IGMP3 report parsing is looking at the wrong address for
> group records. This patch fixes it.
>
> Reported-by: Banyeer <banyeer@yahoo.com>
> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
I think you're adding as many bugs as you are fixing here :-)
> @@ -719,11 +719,11 @@ static int br_multicast_igmp3_report(struct net_bridge *br,
> len = sizeof(*ih);
>
> for (i = 0; i < num; i++) {
> + grec = (void *)(skb->data + len);
> len += sizeof(*grec);
> if (!pskb_may_pull(skb, len))
> return -EINVAL;
>
> - grec = (void *)(skb->data + len);
> group = grec->grec_mca;
> type = grec->grec_type;
>
If pskb_may_pull() actually does anything non-trivial,
skb->data will change and you'll be referring to freed
up memory.
That's probably why you had the grec assignment where
you originally had it in the first place :-)
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: bridge: Fix IGMP3 report parsing
2010-04-08 3:52 ` David Miller
@ 2010-04-08 4:07 ` Herbert Xu
2010-04-08 4:21 ` David Miller
0 siblings, 1 reply; 4+ messages in thread
From: Herbert Xu @ 2010-04-08 4:07 UTC (permalink / raw)
To: David Miller; +Cc: netdev, banyeer
On Wed, Apr 07, 2010 at 08:52:48PM -0700, David Miller wrote:
>
> If pskb_may_pull() actually does anything non-trivial,
> skb->data will change and you'll be referring to freed
> up memory.
>
> That's probably why you had the grec assignment where
> you originally had it in the first place :-)
Heh, you're clearly more awake than I was :)
bridge: Fix IGMP3 report parsing
The IGMP3 report parsing is looking at the wrong address for
group records. This patch fixes it.
Reported-by: Banyeer <banyeer@yahoo.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 6980625..f29ada8 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -723,7 +723,7 @@ static int br_multicast_igmp3_report(struct net_bridge *br,
if (!pskb_may_pull(skb, len))
return -EINVAL;
- grec = (void *)(skb->data + len);
+ grec = (void *)(skb->data + len - sizeof(*grec));
group = grec->grec_mca;
type = grec->grec_type;
Thanks,
--
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: bridge: Fix IGMP3 report parsing
2010-04-08 4:07 ` Herbert Xu
@ 2010-04-08 4:21 ` David Miller
0 siblings, 0 replies; 4+ messages in thread
From: David Miller @ 2010-04-08 4:21 UTC (permalink / raw)
To: herbert; +Cc: netdev, banyeer
From: Herbert Xu <herbert@gondor.apana.org.au>
Date: Thu, 8 Apr 2010 12:07:09 +0800
> On Wed, Apr 07, 2010 at 08:52:48PM -0700, David Miller wrote:
>>
>> If pskb_may_pull() actually does anything non-trivial,
>> skb->data will change and you'll be referring to freed
>> up memory.
>>
>> That's probably why you had the grec assignment where
>> you originally had it in the first place :-)
>
> Heh, you're clearly more awake than I was :)
:-)
> bridge: Fix IGMP3 report parsing
>
> The IGMP3 report parsing is looking at the wrong address for
> group records. This patch fixes it.
>
> Reported-by: Banyeer <banyeer@yahoo.com>
> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Applied, thanks Herbert.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2010-04-08 4:21 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2010-04-08 1:26 bridge: Fix IGMP3 report parsing Herbert Xu
2010-04-08 3:52 ` David Miller
2010-04-08 4:07 ` Herbert Xu
2010-04-08 4:21 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.