Re: [PATCH net-next ] mpls: In mpls_egress verify the packet length.

[ebiederm@xmission.com (Eric W. Biederman)]

David Miller <davem@davemloft.net> writes:

> From: ebiederm@xmission.com (Eric W. Biederman)
> Date: Thu, 12 Mar 2015 15:54:52 -0500
>
>> Robert Shearman noticed that mpls_egress is failing to verify that
>> the bytes to be examined are in fact present in the packet before
>> mpls_egress reads those bytes.
>> 
>> Reported-by: Robert Shearman <rshearma@brocade.com>
>> Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
>
> Let's see if we can consolidate these pskb_may_pull() calls into one,
> in the fast path they are relatively cheap but not zero cost.

> The caller (mpls_forward()) is doing one as well.
>
> All you care about is the version field and the hop_limit/ttl.
>
> For ipv4, version is in byte 0, and ttl is in byte 9.
By my count the ttl is in byte 8, and more importantly the
header checksum is in byte 10.

> For ipv6, version is also in byte zero and hop_limit is in byte 7.
>
> Therefore if you do pskb_may_pull(skb, 10) it will cover all cases
> whilst not exceeding the size of either protocol's total header.

Using the value of 12 that seems very reasonable.

> Above the pskb_may_pull() call can add a big comment explaining what
> you are doing and why this is sufficient.

Will do.

Eric