* [PATCH net-2.6] gre: fix improper error handling
@ 2011-07-22 9:26 Dmitry Kozlov
2011-07-22 13:01 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Dmitry Kozlov @ 2011-07-22 9:26 UTC (permalink / raw)
To: davem; +Cc: netdev
Fix improper protocol err_handler, current implementation is fully
unapplicable and may cause kernel crash due to double kfree_skb.
Signed-off-by: Dmitry Kozlov <xeb@mail.ru>
--
net/ipv4/gre.c | 23 +++++++----------------
1 files changed, 7 insertions(+), 16 deletions(-)
diff --git a/net/ipv4/gre.c b/net/ipv4/gre.c
index c6933f2..a8126fe 100644
--- a/net/ipv4/gre.c
+++ b/net/ipv4/gre.c
@@ -15,6 +15,7 @@
#include <linux/kmod.h>
#include <linux/skbuff.h>
#include <linux/in.h>
+#include <linux/ip.h>
#include <linux/netdevice.h>
#include <linux/version.h>
#include <linux/spinlock.h>
@@ -97,27 +98,17 @@ drop:
static void gre_err(struct sk_buff *skb, u32 info)
{
const struct gre_protocol *proto;
- u8 ver;
-
- if (!pskb_may_pull(skb, 12))
- goto drop;
-
- ver = skb->data[1]&0x7f;
+ const struct iphdr *iph = (const struct iphdr *)skb->data;
+ u8 ver = skb->data[(iph->ihl<<2) + 1]&0x7f;
+
if (ver >= GREPROTO_MAX)
- goto drop;
+ return;
rcu_read_lock();
proto = rcu_dereference(gre_proto[ver]);
- if (!proto || !proto->err_handler)
- goto drop_unlock;
- proto->err_handler(skb, info);
- rcu_read_unlock();
- return;
-
-drop_unlock:
+ if (proto && proto->err_handler)
+ proto->err_handler(skb, info);
rcu_read_unlock();
-drop:
- kfree_skb(skb);
}
static const struct net_protocol net_gre_protocol = {
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH net-2.6] gre: fix improper error handling
2011-07-22 9:26 [PATCH net-2.6] gre: fix improper error handling Dmitry Kozlov
@ 2011-07-22 13:01 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2011-07-22 13:01 UTC (permalink / raw)
To: xeb; +Cc: netdev
From: Dmitry Kozlov <xeb@mail.ru>
Date: Fri, 22 Jul 2011 13:26:10 +0400
> Fix improper protocol err_handler, current implementation is fully
> unapplicable and may cause kernel crash due to double kfree_skb.
>
> Signed-off-by: Dmitry Kozlov <xeb@mail.ru>
Your patch has been corrupted by your email client.
For example, it has changed tab characters into sequences of spaces.
This makes your patch unusable.
Please read Documentation/email-clients.txt to learn how to fix this,
and after fixing your setup send a test patch to yourself and try
to apply it just as we would when you post it here.
Only after this self-test passes, should you try to resubmit your
patch.
Thank you.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2011-07-22 13:01 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2011-07-22 9:26 [PATCH net-2.6] gre: fix improper error handling Dmitry Kozlov
2011-07-22 13:01 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).