From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Sabrina Dubroca <sd@queasysnail.net>,
"John W. Linville" <linville@tuxdriver.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 4.4 17/28] geneve: avoid use-after-free of skb->data
Date: Fri, 9 Dec 2016 17:17:59 +0100 [thread overview]
Message-ID: <20161209161748.642522623@linuxfoundation.org> (raw)
In-Reply-To: <20161209161747.923205441@linuxfoundation.org>
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <sd@queasysnail.net>
[ Upstream commit 5b01014759991887b1e450c9def01e58c02ab81b ]
geneve{,6}_build_skb can end up doing a pskb_expand_head(), which
makes the ip_hdr(skb) reference we stashed earlier stale. Since it's
only needed as an argument to ip_tunnel_ecn_encap(), move this
directly in the function call.
Fixes: 08399efc6319 ("geneve: ensure ECN info is handled properly in all tx/rx paths")
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Reviewed-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/geneve.c | 14 ++++----------
1 file changed, 4 insertions(+), 10 deletions(-)
--- a/drivers/net/geneve.c
+++ b/drivers/net/geneve.c
@@ -815,7 +815,6 @@ static netdev_tx_t geneve_xmit_skb(struc
struct geneve_dev *geneve = netdev_priv(dev);
struct geneve_sock *gs4 = geneve->sock4;
struct rtable *rt = NULL;
- const struct iphdr *iip; /* interior IP header */
int err = -EINVAL;
struct flowi4 fl4;
__u8 tos, ttl;
@@ -842,8 +841,6 @@ static netdev_tx_t geneve_xmit_skb(struc
sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true);
skb_reset_mac_header(skb);
- iip = ip_hdr(skb);
-
if (info) {
const struct ip_tunnel_key *key = &info->key;
u8 *opts = NULL;
@@ -859,7 +856,7 @@ static netdev_tx_t geneve_xmit_skb(struc
if (unlikely(err))
goto err;
- tos = ip_tunnel_ecn_encap(key->tos, iip, skb);
+ tos = ip_tunnel_ecn_encap(key->tos, ip_hdr(skb), skb);
ttl = key->ttl;
df = key->tun_flags & TUNNEL_DONT_FRAGMENT ? htons(IP_DF) : 0;
} else {
@@ -869,7 +866,7 @@ static netdev_tx_t geneve_xmit_skb(struc
if (unlikely(err))
goto err;
- tos = ip_tunnel_ecn_encap(fl4.flowi4_tos, iip, skb);
+ tos = ip_tunnel_ecn_encap(fl4.flowi4_tos, ip_hdr(skb), skb);
ttl = geneve->ttl;
if (!ttl && IN_MULTICAST(ntohl(fl4.daddr)))
ttl = 1;
@@ -903,7 +900,6 @@ static netdev_tx_t geneve6_xmit_skb(stru
struct geneve_dev *geneve = netdev_priv(dev);
struct geneve_sock *gs6 = geneve->sock6;
struct dst_entry *dst = NULL;
- const struct iphdr *iip; /* interior IP header */
int err = -EINVAL;
struct flowi6 fl6;
__u8 prio, ttl;
@@ -927,8 +923,6 @@ static netdev_tx_t geneve6_xmit_skb(stru
sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true);
skb_reset_mac_header(skb);
- iip = ip_hdr(skb);
-
if (info) {
const struct ip_tunnel_key *key = &info->key;
u8 *opts = NULL;
@@ -945,7 +939,7 @@ static netdev_tx_t geneve6_xmit_skb(stru
if (unlikely(err))
goto err;
- prio = ip_tunnel_ecn_encap(key->tos, iip, skb);
+ prio = ip_tunnel_ecn_encap(key->tos, ip_hdr(skb), skb);
ttl = key->ttl;
} else {
udp_csum = false;
@@ -954,7 +948,7 @@ static netdev_tx_t geneve6_xmit_skb(stru
if (unlikely(err))
goto err;
- prio = ip_tunnel_ecn_encap(fl6.flowi6_tos, iip, skb);
+ prio = ip_tunnel_ecn_encap(fl6.flowi6_tos, ip_hdr(skb), skb);
ttl = geneve->ttl;
if (!ttl && ipv6_addr_is_multicast(&fl6.daddr))
ttl = 1;
next prev parent reply other threads:[~2016-12-09 16:18 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <CGME20161209161807epcas5p2a4f0544b5e462fc831c24de653b6785e@epcas5p2.samsung.com>
2016-12-09 16:17 ` [PATCH 4.4 00/28] 4.4.38-stable review Greg Kroah-Hartman
2016-12-09 16:17 ` [PATCH 4.4 01/28] virtio-net: add a missing synchronize_net() Greg Kroah-Hartman
2016-12-09 16:17 ` [PATCH 4.4 02/28] net: check dead netns for peernet2id_alloc() Greg Kroah-Hartman
2016-12-09 16:17 ` [PATCH 4.4 03/28] ip6_tunnel: disable caching when the traffic class is inherited Greg Kroah-Hartman
2016-12-09 16:17 ` [PATCH 4.4 04/28] net: sky2: Fix shutdown crash Greg Kroah-Hartman
2016-12-09 16:17 ` [PATCH 4.4 05/28] af_unix: conditionally use freezable blocking calls in read Greg Kroah-Hartman
2016-12-09 16:17 ` [PATCH 4.4 06/28] rtnetlink: fix FDB size computation Greg Kroah-Hartman
2016-12-09 16:17 ` [PATCH 4.4 07/28] l2tp: fix racy SOCK_ZAPPED flag check in l2tp_ip{,6}_bind() Greg Kroah-Hartman
2016-12-09 16:17 ` [PATCH 4.4 08/28] net: dsa: bcm_sf2: Ensure we re-negotiate EEE during after link change Greg Kroah-Hartman
2016-12-09 16:17 ` [PATCH 4.4 09/28] net, sched: respect rcu grace period on cls destruction Greg Kroah-Hartman
2016-12-09 16:17 ` [PATCH 4.4 10/28] net/sched: pedit: make sure that offset is valid Greg Kroah-Hartman
2016-12-09 16:17 ` [PATCH 4.4 11/28] netlink: Call cb->done from a worker thread Greg Kroah-Hartman
2016-12-09 16:17 ` [PATCH 4.4 12/28] netlink: Do not schedule work from sk_destruct Greg Kroah-Hartman
2016-12-09 16:17 ` [PATCH 4.4 13/28] net/dccp: fix use-after-free in dccp_invalid_packet Greg Kroah-Hartman
2016-12-09 16:17 ` [PATCH 4.4 14/28] packet: fix race condition in packet_set_ring Greg Kroah-Hartman
2016-12-09 16:17 ` [PATCH 4.4 15/28] net: bcmgenet: Utilize correct struct device for all DMA operations Greg Kroah-Hartman
2016-12-09 16:17 ` [PATCH 4.4 16/28] sh_eth: remove unchecked interrupts for RZ/A1 Greg Kroah-Hartman
2016-12-09 16:17 ` Greg Kroah-Hartman [this message]
2016-12-09 16:18 ` [PATCH 4.4 18/28] net: avoid signed overflows for SO_{SND|RCV}BUFFORCE Greg Kroah-Hartman
2016-12-09 16:18 ` [PATCH 4.4 19/28] net: ping: check minimum size on ICMP header length Greg Kroah-Hartman
2016-12-09 16:18 ` [PATCH 4.4 20/28] sparc32: Fix inverted invalid_frame_pointer checks on sigreturns Greg Kroah-Hartman
2016-12-09 16:18 ` [PATCH 4.4 21/28] sparc64: Fix find_node warning if numa node cannot be found Greg Kroah-Hartman
2016-12-09 16:18 ` [PATCH 4.4 22/28] sparc64: fix compile warning section mismatch in find_node() Greg Kroah-Hartman
2016-12-09 16:18 ` [PATCH 4.4 23/28] Dont feed anything but regular iovecs to blk_rq_map_user_iov Greg Kroah-Hartman
2016-12-09 16:18 ` [PATCH 4.4 24/28] constify iov_iter_count() and iter_is_iovec() Greg Kroah-Hartman
2016-12-09 16:18 ` [PATCH 4.4 25/28] ipv6: Set skb->protocol properly for local output Greg Kroah-Hartman
2016-12-09 16:18 ` [PATCH 4.4 26/28] ipv4: " Greg Kroah-Hartman
2016-12-09 16:18 ` [PATCH 4.4 27/28] esp4: Fix integrity verification when ESN are used Greg Kroah-Hartman
2016-12-09 16:18 ` [PATCH 4.4 28/28] esp6: " Greg Kroah-Hartman
2016-12-09 18:22 ` [PATCH 4.4 00/28] 4.4.38-stable review Shuah Khan
2016-12-09 22:35 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20161209161748.642522623@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=davem@davemloft.net \
--cc=linux-kernel@vger.kernel.org \
--cc=linville@tuxdriver.com \
--cc=sd@queasysnail.net \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).