From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>,
Jiri Benc <jbenc@redhat.com>,
"David S . Miller" <davem@davemloft.net>,
Sasha Levin <sashal@kernel.org>,
netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 4.14 100/103] ip_gre: fix parsing gre header in ipgre_err
Date: Fri, 8 Nov 2019 06:43:05 -0500 [thread overview]
Message-ID: <20191108114310.14363-100-sashal@kernel.org> (raw)
In-Reply-To: <20191108114310.14363-1-sashal@kernel.org>
From: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>
[ Upstream commit b0350d51f001e6edc13ee4f253b98b50b05dd401 ]
gre_parse_header stops parsing when csum_err is encountered, which means
tpi->key is undefined and ip_tunnel_lookup will return NULL improperly.
This patch introduce a NULL pointer as csum_err parameter. Even when
csum_err is encountered, it won't return error and continue parsing gre
header as expected.
Fixes: 9f57c67c379d ("gre: Remove support for sharing GRE protocol hook.")
Reported-by: Jiri Benc <jbenc@redhat.com>
Signed-off-by: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/gre_demux.c | 7 ++++---
net/ipv4/ip_gre.c | 9 +++------
2 files changed, 7 insertions(+), 9 deletions(-)
diff --git a/net/ipv4/gre_demux.c b/net/ipv4/gre_demux.c
index b798862b6be5d..7efe740c06ebf 100644
--- a/net/ipv4/gre_demux.c
+++ b/net/ipv4/gre_demux.c
@@ -86,13 +86,14 @@ int gre_parse_header(struct sk_buff *skb, struct tnl_ptk_info *tpi,
options = (__be32 *)(greh + 1);
if (greh->flags & GRE_CSUM) {
- if (skb_checksum_simple_validate(skb)) {
+ if (!skb_checksum_simple_validate(skb)) {
+ skb_checksum_try_convert(skb, IPPROTO_GRE, 0,
+ null_compute_pseudo);
+ } else if (csum_err) {
*csum_err = true;
return -EINVAL;
}
- skb_checksum_try_convert(skb, IPPROTO_GRE, 0,
- null_compute_pseudo);
options++;
}
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 347be2ea78d4a..f8d3a7ddf62af 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -230,13 +230,10 @@ static void gre_err(struct sk_buff *skb, u32 info)
const int type = icmp_hdr(skb)->type;
const int code = icmp_hdr(skb)->code;
struct tnl_ptk_info tpi;
- bool csum_err = false;
- if (gre_parse_header(skb, &tpi, &csum_err, htons(ETH_P_IP),
- iph->ihl * 4) < 0) {
- if (!csum_err) /* ignore csum errors. */
- return;
- }
+ if (gre_parse_header(skb, &tpi, NULL, htons(ETH_P_IP),
+ iph->ihl * 4) < 0)
+ return;
if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) {
ipv4_update_pmtu(skb, dev_net(skb->dev), info,
--
2.20.1
next prev parent reply other threads:[~2019-11-08 11:56 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20191108114310.14363-1-sashal@kernel.org>
2019-11-08 11:41 ` [PATCH AUTOSEL 4.14 003/103] ath10k: fix kernel panic by moving pci flush after napi_disable Sasha Levin
2019-11-08 11:41 ` [PATCH AUTOSEL 4.14 013/103] cfg80211: Avoid regulatory restore when COUNTRY_IE_IGNORE is set Sasha Levin
2019-11-08 11:41 ` [PATCH AUTOSEL 4.14 015/103] ath9k: fix tx99 with monitor mode interface Sasha Levin
2019-11-08 11:41 ` [PATCH AUTOSEL 4.14 016/103] ath10k: limit available channels via DT ieee80211-freq-limit Sasha Levin
2019-11-08 11:41 ` [PATCH AUTOSEL 4.14 022/103] liquidio: fix race condition in instruction completion processing Sasha Levin
2019-11-08 11:41 ` [PATCH AUTOSEL 4.14 024/103] i40e: use correct length for strncpy Sasha Levin
2019-11-08 11:41 ` [PATCH AUTOSEL 4.14 025/103] i40e: hold the rtnl lock on clearing interrupt scheme Sasha Levin
2019-11-08 11:41 ` [PATCH AUTOSEL 4.14 026/103] i40e: Prevent deleting MAC address from VF when set by PF Sasha Levin
2019-11-08 11:41 ` [PATCH AUTOSEL 4.14 028/103] iwlwifi: don't WARN on trying to dump dead firmware Sasha Levin
2019-11-08 11:41 ` [PATCH AUTOSEL 4.14 029/103] iwlwifi: mvm: avoid sending too many BARs Sasha Levin
2019-11-08 11:41 ` [PATCH AUTOSEL 4.14 032/103] rtl8187: Fix warning generated when strncpy() destination length matches the sixe argument Sasha Levin
2019-11-08 11:42 ` [PATCH AUTOSEL 4.14 035/103] net: phy: mscc: read 'vsc8531,vddmac' as an u32 Sasha Levin
2019-11-08 11:42 ` [PATCH AUTOSEL 4.14 036/103] net: phy: mscc: read 'vsc8531, edge-slowdown' " Sasha Levin
2019-11-08 11:42 ` [PATCH AUTOSEL 4.14 039/103] net: lan78xx: Bail out if lan78xx_get_endpoints fails Sasha Levin
2019-11-08 11:42 ` [PATCH AUTOSEL 4.14 042/103] ath10k: wmi: disable softirq's while calling ieee80211_rx Sasha Levin
2019-11-08 11:42 ` [PATCH AUTOSEL 4.14 062/103] ath9k: add back support for using active monitor interfaces for tx99 Sasha Levin
2019-11-08 11:42 ` [PATCH AUTOSEL 4.14 085/103] MIPS: lantiq: Do not enable IRQs in dma open Sasha Levin
2019-11-08 11:42 ` [PATCH AUTOSEL 4.14 086/103] llc: avoid blocking in llc_sap_close() Sasha Levin
2019-11-08 11:42 ` [PATCH AUTOSEL 4.14 092/103] cxgb4: Fix endianness issue in t4_fwcache() Sasha Levin
2019-11-08 11:43 ` Sasha Levin [this message]
2019-11-08 11:43 ` [PATCH AUTOSEL 4.14 103/103] ath9k: Fix a locking bug in ath9k_add_interface() Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191108114310.14363-100-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=davem@davemloft.net \
--cc=jbenc@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=yanhaishuang@cmss.chinamobile.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).