diff options
| author | Haishuang Yan <yanhaishuang@cmss.chinamobile.com> | 2017-12-20 02:53:19 +0100 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2017-12-20 19:48:39 +0100 |
| commit | 293a1991cf0d62d0a60b41af42f1dd601d5029fc (patch) | |
| tree | c1b96a3713796fac03b1eafd434ab84375b4078a /net/ipv6/ip6_gre.c | |
| parent | net: amd-xgbe: Get rid of custom hex_dump_to_buffer() (diff) | |
| download | linux-293a1991cf0d62d0a60b41af42f1dd601d5029fc.tar.xz linux-293a1991cf0d62d0a60b41af42f1dd601d5029fc.zip | |
ip6_gre: fix a pontential issue in ip6erspan_rcv
pskb_may_pull() can change skb->data, so we need to load ipv6h/ershdr at
the right place.
Fixes: 5a963eb61b7c ("ip6_gre: Add ERSPAN native tunnel support")
Cc: William Tu <u9012063@gmail.com>
Acked-by: William Tu <u9012063@gmail.com>
Signed-off-by: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv6/ip6_gre.c')
| -rw-r--r-- | net/ipv6/ip6_gre.c | 5 |
1 files changed, 2 insertions, 3 deletions
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c index 87b9892dfa23..9bd110371fe3 100644 --- a/net/ipv6/ip6_gre.c +++ b/net/ipv6/ip6_gre.c @@ -507,12 +507,11 @@ static int ip6erspan_rcv(struct sk_buff *skb, int gre_hdr_len, struct ip6_tnl *tunnel; u8 ver; - ipv6h = ipv6_hdr(skb); - ershdr = (struct erspan_base_hdr *)skb->data; - if (unlikely(!pskb_may_pull(skb, sizeof(*ershdr)))) return PACKET_REJECT; + ipv6h = ipv6_hdr(skb); + ershdr = (struct erspan_base_hdr *)skb->data; ver = (ntohs(ershdr->ver_vlan) & VER_MASK) >> VER_OFFSET; tpi->key = cpu_to_be32(ntohs(ershdr->session_id) & ID_MASK); |