From: Steffen Klassert <steffen.klassert@secunet.com>
To: David Miller <davem@davemloft.net>
Cc: Pravin Shelar <pshelar@nicira.com>, netdev@vger.kernel.org
Subject: [PATCH net v2 1/4] ip_tunnel: Fix a memory corruption in ip_tunnel_xmit
Date: Tue, 1 Oct 2013 11:33:59 +0200 [thread overview]
Message-ID: <20131001093359.GG7660@secunet.com> (raw)
We might extend the used aera of a skb beyond the total
headroom when we install the ipip header. Fix this by
calling skb_cow_head() unconditionally.
Bug was introduced with commit c544193214
("GRE: Refactor GRE tunneling code.")
Cc: Pravin Shelar <pshelar@nicira.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
---
v2: Add a reference to the commit that introduced bug to the commit message
net/ipv4/ip_tunnel.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index d3fbad4..dfc6d8a 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -642,13 +642,13 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
max_headroom = LL_RESERVED_SPACE(rt->dst.dev) + sizeof(struct iphdr)
+ rt->dst.header_len;
- if (max_headroom > dev->needed_headroom) {
+ if (max_headroom > dev->needed_headroom)
dev->needed_headroom = max_headroom;
- if (skb_cow_head(skb, dev->needed_headroom)) {
- dev->stats.tx_dropped++;
- dev_kfree_skb(skb);
- return;
- }
+
+ if (skb_cow_head(skb, dev->needed_headroom)) {
+ dev->stats.tx_dropped++;
+ dev_kfree_skb(skb);
+ return;
}
err = iptunnel_xmit(rt, skb, fl4.saddr, fl4.daddr, protocol,
--
1.7.9.5
next reply other threads:[~2013-10-01 9:34 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-10-01 9:33 Steffen Klassert [this message]
2013-10-01 9:34 ` [PATCH net v2 2/4] ip_tunnel: Add fallback tunnels to the hash lists Steffen Klassert
2013-10-01 16:43 ` David Miller
2013-10-01 9:35 ` [PATCH net 3/4] ip_tunnel_core: Change __skb_push back to skb_push Steffen Klassert
2013-10-01 16:43 ` David Miller
2013-10-01 9:37 ` [PATCH net 4/4] ip_tunnel: Remove double unregister of the fallback device Steffen Klassert
2013-10-01 10:00 ` Nicolas Dichtel
2013-10-01 10:40 ` Steffen Klassert
2013-10-01 11:30 ` Nicolas Dichtel
2013-10-01 16:04 ` [PATCH net 1/2] sit: allow to use rtnl ops on fb tunnel Nicolas Dichtel
2013-10-01 16:05 ` [PATCH net 2/2] ip6tnl: " Nicolas Dichtel
2013-10-01 16:59 ` David Miller
2013-10-02 7:16 ` Nicolas Dichtel
2013-10-01 16:59 ` [PATCH net 1/2] sit: " David Miller
2013-10-02 7:15 ` Nicolas Dichtel
2013-10-02 7:36 ` Nicolas Dichtel
2013-10-02 21:08 ` David Miller
2013-10-03 8:06 ` Nicolas Dichtel
2013-10-03 17:37 ` David Miller
2013-10-21 23:30 ` Willem de Bruijn
2013-10-22 7:34 ` Nicolas Dichtel
2013-10-01 16:43 ` [PATCH net 4/4] ip_tunnel: Remove double unregister of the fallback device David Miller
2013-10-01 16:43 ` [PATCH net v2 1/4] ip_tunnel: Fix a memory corruption in ip_tunnel_xmit David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20131001093359.GG7660@secunet.com \
--to=steffen.klassert@secunet.com \
--cc=davem@davemloft.net \
--cc=netdev@vger.kernel.org \
--cc=pshelar@nicira.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).