summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAndrea Mayer <andrea.mayer@uniroma2.it>2019-11-16 16:05:52 +0100
committerDavid S. Miller <davem@davemloft.net>2019-11-16 12:18:32 -0800
commit7f91ed8c4f4b6368b0603543bccb6b5fd10804e1 (patch)
tree1f3160d93a6cc2d0e14b5ae4822cc99ef89864d9
parentacb9bdc1482280b0164d638ecd416eff6f694e9c (diff)
seg6: fix srh pointer in get_srh()
pskb_may_pull may change pointers in header. For this reason, it is mandatory to reload any pointer that points into skb header. Signed-off-by: Andrea Mayer <andrea.mayer@uniroma2.it> Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r--net/ipv6/seg6_local.c5
1 files changed, 5 insertions, 0 deletions
diff --git a/net/ipv6/seg6_local.c b/net/ipv6/seg6_local.c
index 9d4f75e0d33a..5e3d7004d431 100644
--- a/net/ipv6/seg6_local.c
+++ b/net/ipv6/seg6_local.c
@@ -81,6 +81,11 @@ static struct ipv6_sr_hdr *get_srh(struct sk_buff *skb)
if (!pskb_may_pull(skb, srhoff + len))
return NULL;
+ /* note that pskb_may_pull may change pointers in header;
+ * for this reason it is necessary to reload them when needed.
+ */
+ srh = (struct ipv6_sr_hdr *)(skb->data + srhoff);
+
if (!seg6_validate_srh(srh, len))
return NULL;