summaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorJosh Hunt <johunt@akamai.com>2015-06-08 18:00:59 +0200
committerDavid S. Miller <davem@davemloft.net>2015-06-08 21:13:17 +0200
commit0243508edd317ff1fa63b495643a7c192fbfcd92 (patch)
treead7aed1bf7565af3f7220b76ba579880df4f79f3 /net
parentipv6: fix possible use after free of dev stats (diff)
downloadlinux-0243508edd317ff1fa63b495643a7c192fbfcd92.tar.xz
linux-0243508edd317ff1fa63b495643a7c192fbfcd92.zip
ipv6: Fix protocol resubmission
UDP encapsulation is broken on IPv6. This is because the logic to resubmit the nexthdr is inverted, checking for a ret value > 0 instead of < 0. Also, the resubmit label is in the wrong position since we already get the nexthdr value when performing decapsulation. In addition the skb pull is no longer necessary either. This changes the return value check to look for < 0, using it for the nexthdr on the next iteration, and moves the resubmit label to the proper location. With these changes the v6 code now matches what we do in the v4 ip input code wrt resubmitting when decapsulating. Signed-off-by: Josh Hunt <johunt@akamai.com> Acked-by: "Tom Herbert" <tom@herbertland.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r--net/ipv6/ip6_input.c8
1 files changed, 5 insertions, 3 deletions
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index f2e464eba5ef..41a73da371a9 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -212,13 +212,13 @@ static int ip6_input_finish(struct sock *sk, struct sk_buff *skb)
*/
rcu_read_lock();
-resubmit:
idev = ip6_dst_idev(skb_dst(skb));
if (!pskb_pull(skb, skb_transport_offset(skb)))
goto discard;
nhoff = IP6CB(skb)->nhoff;
nexthdr = skb_network_header(skb)[nhoff];
+resubmit:
raw = raw6_local_deliver(skb, nexthdr);
ipprot = rcu_dereference(inet6_protos[nexthdr]);
if (ipprot) {
@@ -246,10 +246,12 @@ resubmit:
goto discard;
ret = ipprot->handler(skb);
- if (ret > 0)
+ if (ret < 0) {
+ nexthdr = -ret;
goto resubmit;
- else if (ret == 0)
+ } else if (ret == 0) {
IP6_INC_STATS_BH(net, idev, IPSTATS_MIB_INDELIVERS);
+ }
} else {
if (!raw) {
if (xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {