* [PATCH] cls_rsvp: add sanity check for the packet length
@ 2010-08-04 8:55 Changli Gao
2010-08-04 13:42 ` jamal
0 siblings, 1 reply; 4+ messages in thread
From: Changli Gao @ 2010-08-04 8:55 UTC (permalink / raw)
To: Jamal Hadi Salim; +Cc: David S. Miller, netdev, Changli Gao
The packet length should be checked before the packet data is dereferenced.
Signed-off-by: Changli Gao <xiaosuo@gmail.com>
---
net/sched/cls_rsvp.h | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/net/sched/cls_rsvp.h b/net/sched/cls_rsvp.h
index dd9414e..4fa119d 100644
--- a/net/sched/cls_rsvp.h
+++ b/net/sched/cls_rsvp.h
@@ -143,9 +143,17 @@ static int rsvp_classify(struct sk_buff *skb, struct tcf_proto *tp,
u8 tunnelid = 0;
u8 *xprt;
#if RSVP_DST_LEN == 4
- struct ipv6hdr *nhptr = ipv6_hdr(skb);
+ struct ipv6hdr *nhptr;
+
+ if (!pskb_may_pull(skb, skb_network_offset(skb) + sizeof(*nhptr)))
+ return -1;
+ nhptr = ipv6_hdr(skb);
#else
struct iphdr *nhptr = ip_hdr(skb);
+
+ if (!pskb_may_pull(skb, skb_network_offset(skb) + sizeof(*nhptr)))
+ return -1;
+ nhptr = ip_hdr(skb);
#endif
restart:
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] cls_rsvp: add sanity check for the packet length
2010-08-04 8:55 [PATCH] cls_rsvp: add sanity check for the packet length Changli Gao
@ 2010-08-04 13:42 ` jamal
2010-08-04 13:44 ` Changli Gao
0 siblings, 1 reply; 4+ messages in thread
From: jamal @ 2010-08-04 13:42 UTC (permalink / raw)
To: Changli Gao; +Cc: David S. Miller, netdev
On Wed, 2010-08-04 at 16:55 +0800, Changli Gao wrote:
> The packet length should be checked before the packet data is dereferenced.
>
> Signed-off-by: Changli Gao <xiaosuo@gmail.com>
> ---
> net/sched/cls_rsvp.h | 10 +++++++++-
> 1 file changed, 9 insertions(+), 1 deletion(-)
> diff --git a/net/sched/cls_rsvp.h b/net/sched/cls_rsvp.h
> index dd9414e..4fa119d 100644
> --- a/net/sched/cls_rsvp.h
> +++ b/net/sched/cls_rsvp.h
> @@ -143,9 +143,17 @@ static int rsvp_classify(struct sk_buff *skb, struct tcf_proto *tp,
> u8 tunnelid = 0;
> u8 *xprt;
> #if RSVP_DST_LEN == 4
> - struct ipv6hdr *nhptr = ipv6_hdr(skb);
> + struct ipv6hdr *nhptr;
> +
> + if (!pskb_may_pull(skb, skb_network_offset(skb) + sizeof(*nhptr)))
> + return -1;
> + nhptr = ipv6_hdr(skb);
> #else
> struct iphdr *nhptr = ip_hdr(skb);
> +
> + if (!pskb_may_pull(skb, skb_network_offset(skb) + sizeof(*nhptr)))
> + return -1;
> + nhptr = ip_hdr(skb);
> #endif
Maybe a good time to move nhptr declaration outside #if since it is used
in #else as well.
Otherwise:
Acked-by: Jamal Hadi Salim <hadi@cyberus.ca>
cheers,
jamal
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] cls_rsvp: add sanity check for the packet length
2010-08-04 13:42 ` jamal
@ 2010-08-04 13:44 ` Changli Gao
2010-08-04 13:52 ` Changli Gao
0 siblings, 1 reply; 4+ messages in thread
From: Changli Gao @ 2010-08-04 13:44 UTC (permalink / raw)
To: hadi; +Cc: David S. Miller, netdev
On Wed, Aug 4, 2010 at 9:42 PM, jamal <hadi@cyberus.ca> wrote:
> On Wed, 2010-08-04 at 16:55 +0800, Changli Gao wrote:
>> The packet length should be checked before the packet data is dereferenced.
>>
>> Signed-off-by: Changli Gao <xiaosuo@gmail.com>
>> ---
>> net/sched/cls_rsvp.h | 10 +++++++++-
>> 1 file changed, 9 insertions(+), 1 deletion(-)
>> diff --git a/net/sched/cls_rsvp.h b/net/sched/cls_rsvp.h
>> index dd9414e..4fa119d 100644
>> --- a/net/sched/cls_rsvp.h
>> +++ b/net/sched/cls_rsvp.h
>> @@ -143,9 +143,17 @@ static int rsvp_classify(struct sk_buff *skb, struct tcf_proto *tp,
>> u8 tunnelid = 0;
>> u8 *xprt;
>> #if RSVP_DST_LEN == 4
>> - struct ipv6hdr *nhptr = ipv6_hdr(skb);
>> + struct ipv6hdr *nhptr;
>> +
>> + if (!pskb_may_pull(skb, skb_network_offset(skb) + sizeof(*nhptr)))
>> + return -1;
>> + nhptr = ipv6_hdr(skb);
>> #else
>> struct iphdr *nhptr = ip_hdr(skb);
>> +
>> + if (!pskb_may_pull(skb, skb_network_offset(skb) + sizeof(*nhptr)))
>> + return -1;
>> + nhptr = ip_hdr(skb);
>> #endif
>
> Maybe a good time to move nhptr declaration outside #if since it is used
> in #else as well.
>
They are not the same type. I am afraid that it won't work.
--
Regards,
Changli Gao(xiaosuo@gmail.com)
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] cls_rsvp: add sanity check for the packet length
2010-08-04 13:44 ` Changli Gao
@ 2010-08-04 13:52 ` Changli Gao
0 siblings, 0 replies; 4+ messages in thread
From: Changli Gao @ 2010-08-04 13:52 UTC (permalink / raw)
To: hadi; +Cc: David S. Miller, netdev
On Wed, Aug 4, 2010 at 9:44 PM, Changli Gao <xiaosuo@gmail.com> wrote:
> On Wed, Aug 4, 2010 at 9:42 PM, jamal <hadi@cyberus.ca> wrote:
>> On Wed, 2010-08-04 at 16:55 +0800, Changli Gao wrote:
>>> The packet length should be checked before the packet data is dereferenced.
>>>
>>> Signed-off-by: Changli Gao <xiaosuo@gmail.com>
>>> ---
>>> net/sched/cls_rsvp.h | 10 +++++++++-
>>> 1 file changed, 9 insertions(+), 1 deletion(-)
>>> diff --git a/net/sched/cls_rsvp.h b/net/sched/cls_rsvp.h
>>> index dd9414e..4fa119d 100644
>>> --- a/net/sched/cls_rsvp.h
>>> +++ b/net/sched/cls_rsvp.h
>>> @@ -143,9 +143,17 @@ static int rsvp_classify(struct sk_buff *skb, struct tcf_proto *tp,
>>> u8 tunnelid = 0;
>>> u8 *xprt;
>>> #if RSVP_DST_LEN == 4
>>> - struct ipv6hdr *nhptr = ipv6_hdr(skb);
>>> + struct ipv6hdr *nhptr;
>>> +
>>> + if (!pskb_may_pull(skb, skb_network_offset(skb) + sizeof(*nhptr)))
>>> + return -1;
>>> + nhptr = ipv6_hdr(skb);
>>> #else
>>> struct iphdr *nhptr = ip_hdr(skb);
>>> +
>>> + if (!pskb_may_pull(skb, skb_network_offset(skb) + sizeof(*nhptr)))
>>> + return -1;
>>> + nhptr = ip_hdr(skb);
>>> #endif
>>
>> Maybe a good time to move nhptr declaration outside #if since it is used
>> in #else as well.
>>
>
> They are not the same type. I am afraid that it won't work.
>
I'll respin it with the routine pskb_network_may_pull(). Thanks.
--
Regards,
Changli Gao(xiaosuo@gmail.com)
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2010-08-04 13:53 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-08-04 8:55 [PATCH] cls_rsvp: add sanity check for the packet length Changli Gao
2010-08-04 13:42 ` jamal
2010-08-04 13:44 ` Changli Gao
2010-08-04 13:52 ` Changli Gao
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).