From mboxrd@z Thu Jan 1 00:00:00 1970 From: Simon Horman Subject: [PATCH v2] netfilter: Correct calculation using skb->tail and skb-network_header Date: Fri, 31 May 2013 09:05:46 +0900 Message-ID: <1369958746-26318-1-git-send-email-horms@verge.net.au> Cc: netdev@vger.kernel.org, netfilter-devel@vger.kernel.org, Chen Gang , Simon Horman To: Pablo Neira Ayuso , David Miller Return-path: Received: from kirsty.vergenet.net ([202.4.237.240]:60498 "EHLO kirsty.vergenet.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751095Ab3EaAFK (ORCPT ); Thu, 30 May 2013 20:05:10 -0400 Sender: netfilter-devel-owner@vger.kernel.org List-ID: This corrects an regression introduced by "net: Use 16bits for *_headers fields of struct skbuff" when NET_SKBUFF_DATA_USES_OFFSET is not set. In that case skb->tail will be a pointer whereas skb->network_header will be an offset from head. This is corrected by using wrappers that ensure that calculations are always made using pointers. Reported-by: Stephen Rothwell Reported-by: Chen Gang Signed-off-by: Simon Horman -- v2 * Use skb_tail_pointer() to ensure the tail portion of the calculation is always a pointer - it is not if NET_SKBUFF_DATA_USES_OFFSET is not set. --- net/netfilter/nf_nat_helper.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/netfilter/nf_nat_helper.c b/net/netfilter/nf_nat_helper.c index 5fea563..85e20a9 100644 --- a/net/netfilter/nf_nat_helper.c +++ b/net/netfilter/nf_nat_helper.c @@ -104,7 +104,7 @@ static void mangle_contents(struct sk_buff *skb, /* move post-replacement */ memmove(data + match_offset + rep_len, data + match_offset + match_len, - skb->tail - (skb->network_header + dataoff + + skb_tail_pointer(skb) - (skb_network_header(skb) + dataoff + match_offset + match_len)); /* insert data from buffer */ -- 1.7.10.4