linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Romain Kuntz <r.kuntz@ipflavors.com>,
	Steffen Klassert <steffen.klassert@secunet.com>,
	"David S. Miller" <davem@davemloft.net>
Subject: [ 11/36] ipv6: fix header length calculation in ip6_append_data()
Date: Tue, 12 Feb 2013 12:41:05 -0800	[thread overview]
Message-ID: <20130212203858.645941949@linuxfoundation.org> (raw)
In-Reply-To: <20130212203857.305594226@linuxfoundation.org>

3.4-stable review patch.  If anyone has any objections, please let me know.

------------------


From: Romain KUNTZ <r.kuntz@ipflavors.com>

[ Upstream commit 7efdba5bd9a2f3e2059beeb45c9fa55eefe1bced ]

Commit 299b0767 (ipv6: Fix IPsec slowpath fragmentation problem)
has introduced a error in the header length calculation that
provokes corrupted packets when non-fragmentable extensions
headers (Destination Option or Routing Header Type 2) are used.

rt->rt6i_nfheader_len is the length of the non-fragmentable
extension header, and it should be substracted to
rt->dst.header_len, and not to exthdrlen, as it was done before
commit 299b0767.

This patch reverts to the original and correct behavior. It has
been successfully tested with and without IPsec on packets
that include non-fragmentable extensions headers.

Signed-off-by: Romain Kuntz <r.kuntz@ipflavors.com>
Acked-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv6/ip6_output.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1287,10 +1287,10 @@ int ip6_append_data(struct sock *sk, int
 		cork->length = 0;
 		sk->sk_sndmsg_page = NULL;
 		sk->sk_sndmsg_off = 0;
-		exthdrlen = (opt ? opt->opt_flen : 0) - rt->rt6i_nfheader_len;
+		exthdrlen = (opt ? opt->opt_flen : 0);
 		length += exthdrlen;
 		transhdrlen += exthdrlen;
-		dst_exthdrlen = rt->dst.header_len;
+		dst_exthdrlen = rt->dst.header_len - rt->rt6i_nfheader_len;
 	} else {
 		rt = (struct rt6_info *)cork->dst;
 		fl6 = &inet->cork.fl.u.ip6;



  parent reply	other threads:[~2013-02-12 20:50 UTC|newest]

Thread overview: 39+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2013-02-12 20:40 [ 00/36] 3.4.31-stable review Greg Kroah-Hartman
2013-02-12 20:40 ` [ 01/36] rtlwifi: Fix the usage of the wrong variable in usb.c Greg Kroah-Hartman
2013-02-12 20:40 ` [ 02/36] rtlwifi: Fix scheduling while atomic bug Greg Kroah-Hartman
2013-02-12 20:40 ` [ 03/36] virtio_console: Dont access uninitialized data Greg Kroah-Hartman
2013-02-12 20:40 ` [ 04/36] kernel/resource.c: fix stack overflow in __reserve_region_with_split() Greg Kroah-Hartman
2013-02-12 20:40 ` [ 05/36] Bluetooth: Fix handling of unexpected SMP PDUs Greg Kroah-Hartman
2013-02-12 20:41 ` [ 06/36] efi: Make efi_enabled a function to query EFI facilities Greg Kroah-Hartman
2013-02-12 20:41 ` [ 07/36] samsung-laptop: Disable on EFI hardware Greg Kroah-Hartman
2013-02-12 20:41 ` [ 08/36] net: prevent setting ttl=0 via IP_TTL Greg Kroah-Hartman
2013-02-12 20:41 ` [ 09/36] ipv6: fix the noflags test in addrconf_get_prefix_route Greg Kroah-Hartman
2013-02-12 20:41 ` [ 10/36] MAINTAINERS: Stephen Hemminger email change Greg Kroah-Hartman
2013-02-12 20:41 ` Greg Kroah-Hartman [this message]
2013-02-12 20:41 ` [ 12/36] net: calxedaxgmac: throw away overrun frames Greg Kroah-Hartman
2013-02-12 20:41 ` [ 13/36] net/mlx4_en: Fix bridged vSwitch configuration for non SRIOV mode Greg Kroah-Hartman
2013-02-12 20:41 ` [ 14/36] net/mlx4_core: Set number of msix vectors under SRIOV mode to firmware defaults Greg Kroah-Hartman
2013-02-12 20:41 ` [ 15/36] isdn/gigaset: fix zero size border case in debug dump Greg Kroah-Hartman
2013-02-12 20:41 ` [ 16/36] netxen: fix off by one bug in netxen_release_tx_buffer() Greg Kroah-Hartman
2013-02-12 20:41 ` [ 17/36] r8169: remove the obsolete and incorrect AMD workaround Greg Kroah-Hartman
2013-02-12 20:41 ` [ 18/36] net: loopback: fix a dst refcounting issue Greg Kroah-Hartman
2013-02-12 20:41 ` [ 19/36] pktgen: correctly handle failures when adding a device Greg Kroah-Hartman
2013-02-12 20:41 ` [ 20/36] ipv6: do not create neighbor entries for local delivery Greg Kroah-Hartman
2013-02-12 20:41 ` [ 21/36] via-rhine: Fix bugs in NAPI support Greg Kroah-Hartman
2013-02-12 20:41 ` [ 22/36] packet: fix leakage of tx_ring memory Greg Kroah-Hartman
2013-02-12 20:41 ` [ 23/36] atm/iphase: rename fregt_t -> ffreg_t Greg Kroah-Hartman
2013-02-12 20:41 ` [ 24/36] sctp: refactor sctp_outq_teardown to insure proper re-initalization Greg Kroah-Hartman
2013-02-12 20:41 ` [ 25/36] net: sctp: sctp_setsockopt_auth_key: use kzfree instead of kfree Greg Kroah-Hartman
2013-02-12 20:41 ` [ 26/36] net: sctp: sctp_endpoint_free: zero out secret key data Greg Kroah-Hartman
2013-02-12 20:41 ` [ 27/36] xen/netback: shutdown the ring if it contains garbage Greg Kroah-Hartman
2013-02-12 20:41 ` [ 28/36] xen/netback: dont leak pages on failure in xen_netbk_tx_check_gop Greg Kroah-Hartman
2013-02-12 20:41 ` [ 29/36] xen/netback: free already allocated memory on failure in xen_netbk_get_requests Greg Kroah-Hartman
2013-02-12 20:41 ` [ 30/36] netback: correct netbk_tx_err to handle wrap around Greg Kroah-Hartman
2013-02-12 20:41 ` [ 31/36] tcp: frto should not set snd_cwnd to 0 Greg Kroah-Hartman
2013-02-12 20:41 ` [ 32/36] tcp: fix for zero packets_in_flight was too broad Greg Kroah-Hartman
2013-02-12 20:41 ` [ 33/36] bridge: Pull ip header into skb->data before looking into ip header Greg Kroah-Hartman
2013-02-12 20:41 ` [ 34/36] tg3: Avoid null pointer dereference in tg3_interrupt in netconsole mode Greg Kroah-Hartman
2013-02-12 20:41 ` [ 35/36] tg3: Fix crc errors on jumbo frame receive Greg Kroah-Hartman
2013-02-12 20:41 ` [ 36/36] be2net: Fix to trim skb for padded vlan packets to workaround an ASIC Bug Greg Kroah-Hartman
2013-02-13  9:23 ` [ 00/36] 3.4.31-stable review Satoru Takeuchi
2013-02-13 15:52 ` Shuah Khan

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20130212203858.645941949@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=davem@davemloft.net \
    --cc=linux-kernel@vger.kernel.org \
    --cc=r.kuntz@ipflavors.com \
    --cc=stable@vger.kernel.org \
    --cc=steffen.klassert@secunet.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).