From: Patrick McHardy <kaber@trash.net>
To: "David S. Miller" <davem@davemloft.net>
Cc: Kernel Netdev Mailing List <netdev@vger.kernel.org>
Subject: [XFRM]: esp: fix skb_tail_pointer conversion bug
Date: Sun, 08 Apr 2007 08:08:54 +0200 [thread overview]
Message-ID: <461886F6.1010308@trash.net> (raw)
[-- Attachment #1: Type: text/plain, Size: 0 bytes --]
[-- Attachment #2: x --]
[-- Type: text/plain, Size: 1924 bytes --]
[XFRM]: esp: fix skb_tail_pointer conversion bug
Fix incorrect switch of "trailer" skb by "skb" during skb_tail_pointer
conversion:
- *(u8*)(trailer->tail - 1) = top_iph->protocol;
+ *(skb_tail_pointer(skb) - 1) = top_iph->protocol;
- *(u8 *)(trailer->tail - 1) = *skb_network_header(skb);
+ *(skb_tail_pointer(skb) - 1) = *skb_network_header(skb);
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit c43f271709475c491e425086b8c4a166ae4f3478
tree d9a52c51bd4a03f7d7f7930a25d8fc38d96db8e5
parent 5b83c3481951802b1fa171718e022565d78185a7
author Patrick McHardy <kaber@trash.net> Sun, 08 Apr 2007 08:07:01 +0200
committer Patrick McHardy <kaber@trash.net> Sun, 08 Apr 2007 08:07:01 +0200
net/ipv4/esp4.c | 2 +-
net/ipv6/esp6.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index 7459251..47c95e8 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -64,7 +64,7 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb)
esph = (struct ip_esp_hdr *)(skb_network_header(skb) +
top_iph->ihl * 4);
top_iph->tot_len = htons(skb->len + alen);
- *(skb_tail_pointer(skb) - 1) = top_iph->protocol;
+ *(skb_tail_pointer(trailer) - 1) = top_iph->protocol;
/* this is non-NULL only with UDP Encapsulation */
if (x->encap) {
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 61af22d..7107bb7 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -91,7 +91,7 @@ static int esp6_output(struct xfrm_state *x, struct sk_buff *skb)
top_iph = (struct ipv6hdr *)__skb_push(skb, hdr_len);
esph = (struct ipv6_esp_hdr *)skb_transport_header(skb);
top_iph->payload_len = htons(skb->len + alen - sizeof(*top_iph));
- *(skb_tail_pointer(skb) - 1) = *skb_network_header(skb);
+ *(skb_tail_pointer(trailer) - 1) = *skb_network_header(skb);
*skb_network_header(skb) = IPPROTO_ESP;
esph->spi = x->id.spi;
next reply other threads:[~2007-04-08 6:08 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2007-04-08 6:08 Patrick McHardy [this message]
2007-04-08 13:07 ` [XFRM]: esp: fix skb_tail_pointer conversion bug Arnaldo Carvalho de Melo
2007-04-09 18:46 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=461886F6.1010308@trash.net \
--to=kaber@trash.net \
--cc=davem@davemloft.net \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.