* [PATCH] ipv4: fix a potential use after free in fou.c
@ 2014-10-17 8:53 roy.qing.li
2014-10-18 3:46 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: roy.qing.li @ 2014-10-17 8:53 UTC (permalink / raw)
To: netdev; +Cc: therbert
From: Li RongQing <roy.qing.li@gmail.com>
pskb_may_pull() maybe change skb->data and make uh pointer oboslete,
so reload uh and guehdr
Fixes: 37dd0247 ("gue: Receive side for Generic UDP Encapsulation")
Cc: Tom Herbert <therbert@google.com>
Signed-off-by: Li RongQing <roy.qing.li@gmail.com>
---
net/ipv4/fou.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/ipv4/fou.c b/net/ipv4/fou.c
index efa70ad..32e7892 100644
--- a/net/ipv4/fou.c
+++ b/net/ipv4/fou.c
@@ -87,6 +87,9 @@ static int gue_udp_recv(struct sock *sk, struct sk_buff *skb)
if (!pskb_may_pull(skb, len))
goto drop;
+ uh = udp_hdr(skb);
+ guehdr = (struct guehdr *)&uh[1];
+
if (guehdr->version != 0)
goto drop;
--
1.7.10.4
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] ipv4: fix a potential use after free in fou.c
2014-10-17 8:53 [PATCH] ipv4: fix a potential use after free in fou.c roy.qing.li
@ 2014-10-18 3:46 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2014-10-18 3:46 UTC (permalink / raw)
To: roy.qing.li; +Cc: netdev, therbert
From: roy.qing.li@gmail.com
Date: Fri, 17 Oct 2014 16:53:47 +0800
> From: Li RongQing <roy.qing.li@gmail.com>
>
> pskb_may_pull() maybe change skb->data and make uh pointer oboslete,
> so reload uh and guehdr
>
> Fixes: 37dd0247 ("gue: Receive side for Generic UDP Encapsulation")
> Cc: Tom Herbert <therbert@google.com>
> Signed-off-by: Li RongQing <roy.qing.li@gmail.com>
Applied.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2014-10-18 3:46 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2014-10-17 8:53 [PATCH] ipv4: fix a potential use after free in fou.c roy.qing.li
2014-10-18 3:46 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).