[Patch net] gre: verify packet before using inner header

[Patch net] gre: verify packet before using inner header

[Cong Wang]

From: Cong Wang <amwang@redhat.com>

We use ->h_proto of the inner mac header before calling
pskb_may_pull() to verify the length of the packet.
This might not be a problem, but at least we'd better
error out as early as possible.

Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Pravin B Shelar <pshelar@nicira.com>
Cc: David S. Miller <davem@davemloft.net>
Signed-off-by: Cong Wang <amwang@redhat.com>

---
diff --git a/net/ipv4/gre.c b/net/ipv4/gre.c
index cc22363..8a90c67 100644
--- a/net/ipv4/gre.c
+++ b/net/ipv4/gre.c
@@ -149,6 +149,9 @@ static struct sk_buff *gre_gso_segment(struct sk_buff *skb,
 	} else
 		csum = false;
 
+	if (unlikely(!pskb_may_pull(skb, ghl)))
+		goto out;
+
 	/* setup inner skb. */
 	if (greh->protocol == htons(ETH_P_TEB)) {
 		struct ethhdr *eth = (struct ethhdr *)skb_inner_mac_header(skb);
@@ -158,9 +161,6 @@ static struct sk_buff *gre_gso_segment(struct sk_buff *skb,
 	}
 
 	skb->encapsulation = 0;
-
-	if (unlikely(!pskb_may_pull(skb, ghl)))
-		goto out;
 	__skb_pull(skb, ghl);
 	skb_reset_mac_header(skb);
 	skb_set_network_header(skb, skb_inner_network_offset(skb));

Re: [Patch net] gre: verify packet before using inner header

[Eric Dumazet]

On Tue, 2013-05-07 at 16:20 +0800, Cong Wang wrote:
> From: Cong Wang <amwang@redhat.com>
> 
> We use ->h_proto of the inner mac header before calling
> pskb_may_pull() to verify the length of the packet.
> This might not be a problem, but at least we'd better
> error out as early as possible.
> 
> Cc: Eric Dumazet <eric.dumazet@gmail.com>
> Cc: Pravin B Shelar <pshelar@nicira.com>
> Cc: David S. Miller <davem@davemloft.net>
> Signed-off-by: Cong Wang <amwang@redhat.com>
> 
> ---
> diff --git a/net/ipv4/gre.c b/net/ipv4/gre.c
> index cc22363..8a90c67 100644
> --- a/net/ipv4/gre.c
> +++ b/net/ipv4/gre.c
> @@ -149,6 +149,9 @@ static struct sk_buff *gre_gso_segment(struct sk_buff *skb,
>  	} else
>  		csum = false;
>  
> +	if (unlikely(!pskb_may_pull(skb, ghl)))
> +		goto out;
> +

No, you're adding yet another bug [1]

If you are not sure you fix one, just forget this patch.

[1] Check commits :
d14a489a411937fb9420fe2b05168ee9e1e06c9c
22251c73ca63b5b1050724be9b54910c101a5f30
96af69ea2a83d292238bdba20e4508ee967cf8cb
1b05c4b50edbddbdde715c4a7350629819f6655e
ab43ed8b7490cb387782423ecf74aeee7237e591
9cb429d692b341e972b12e6cd097364050ebbb26

Re: [Patch net] gre: verify packet before using inner header

[Pravin Shelar]

I found easier way to fix this issue. I posted patch - "gso: Handle
Trans-Ether-Bridging protocol in skb_network_protocol()"

On Tue, May 7, 2013 at 6:18 AM, Eric Dumazet <eric.dumazet@gmail.com> wrote:
> On Tue, 2013-05-07 at 16:20 +0800, Cong Wang wrote:
>> From: Cong Wang <amwang@redhat.com>
>>
>> We use ->h_proto of the inner mac header before calling
>> pskb_may_pull() to verify the length of the packet.
>> This might not be a problem, but at least we'd better
>> error out as early as possible.
>>
>> Cc: Eric Dumazet <eric.dumazet@gmail.com>
>> Cc: Pravin B Shelar <pshelar@nicira.com>
>> Cc: David S. Miller <davem@davemloft.net>
>> Signed-off-by: Cong Wang <amwang@redhat.com>
>>
>> ---
>> diff --git a/net/ipv4/gre.c b/net/ipv4/gre.c
>> index cc22363..8a90c67 100644
>> --- a/net/ipv4/gre.c
>> +++ b/net/ipv4/gre.c
>> @@ -149,6 +149,9 @@ static struct sk_buff *gre_gso_segment(struct sk_buff *skb,
>>       } else
>>               csum = false;
>>
>> +     if (unlikely(!pskb_may_pull(skb, ghl)))
>> +             goto out;
>> +
>
> No, you're adding yet another bug [1]
>
> If you are not sure you fix one, just forget this patch.
>
> [1] Check commits :
> d14a489a411937fb9420fe2b05168ee9e1e06c9c
> 22251c73ca63b5b1050724be9b54910c101a5f30
> 96af69ea2a83d292238bdba20e4508ee967cf8cb
> 1b05c4b50edbddbdde715c4a7350629819f6655e
> ab43ed8b7490cb387782423ecf74aeee7237e591
> 9cb429d692b341e972b12e6cd097364050ebbb26
>
>
>