diff options
| author | Dang Hongwu <hongwu.dang@6wind.com> | 2011-01-11 08:13:33 +0100 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2011-01-11 23:03:10 +0100 |
| commit | 4b0ef1f223be4e092632b4152ceec5627ac10f59 (patch) | |
| tree | 79472554ddc96359cdfe07f6b4967dabe9cb5eaa /net/ipv6/ah6.c | |
| parent | ah: update maximum truncated ICV length (diff) | |
| download | linux-4b0ef1f223be4e092632b4152ceec5627ac10f59.tar.xz linux-4b0ef1f223be4e092632b4152ceec5627ac10f59.zip | |
ah: reload pointers to skb data after calling skb_cow_data()
skb_cow_data() may allocate a new data buffer, so pointers on
skb should be set after this function.
Bug was introduced by commit dff3bb06 ("ah4: convert to ahash")
and 8631e9bd ("ah6: convert to ahash").
Signed-off-by: Wang Xuefu <xuefu.wang@6wind.com>
Acked-by: Krzysztof Witek <krzysztof.witek@6wind.com>
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv6/ah6.c')
| -rw-r--r-- | net/ipv6/ah6.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c index ee82d4ef26ce..1aba54ae53c4 100644 --- a/net/ipv6/ah6.c +++ b/net/ipv6/ah6.c @@ -538,14 +538,16 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb) if (!pskb_may_pull(skb, ah_hlen)) goto out; - ip6h = ipv6_hdr(skb); - - skb_push(skb, hdr_len); if ((err = skb_cow_data(skb, 0, &trailer)) < 0) goto out; nfrags = err; + ah = (struct ip_auth_hdr *)skb->data; + ip6h = ipv6_hdr(skb); + + skb_push(skb, hdr_len); + work_iph = ah_alloc_tmp(ahash, nfrags, hdr_len + ahp->icv_trunc_len); if (!work_iph) goto out; |