adulau/aha
1
0
Fork 0
mirror of https://github.com/adulau/aha.git synced 2025-01-01 05:36:24 +00:00
Code Issues Projects Releases Packages Wiki Activity

[IPCOMP]: Fetch nexthdr before ipch is destroyed

Browse source 
When I moved the nexthdr setting out of IPComp I accidently moved
the reading of ipch->nexthdr after the decompression.  Unfortunately
this means that we'd be reading from a stale ipch pointer which
doesn't work very well.

This patch moves the reading up so that we get the correct nexthdr
value.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Herbert Xu 2008-01-29 21:11:46 -08:00 committed by David S. Miller
parent 936f6f8e1b
commit 2614fa59fa
2 changed files with 8 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
net/ipv4/ipcomp.c
View file

@ -74,6 +74,7 @@ out:
static int ipcomp_input(struct xfrm_state *x, struct sk_buff *skb) static int ipcomp_input(struct xfrm_state *x, struct sk_buff *skb)
{ {
int nexthdr;
int err = -ENOMEM; int err = -ENOMEM;
struct ip_comp_hdr *ipch; struct ip_comp_hdr *ipch;
@ -84,13 +85,15 @@ static int ipcomp_input(struct xfrm_state *x, struct sk_buff *skb)
/* Remove ipcomp header and decompress original payload */ /* Remove ipcomp header and decompress original payload */
ipch = (void *)skb->data; ipch = (void *)skb->data;
nexthdr = ipch->nexthdr;
skb->transport_header = skb->network_header + sizeof(*ipch); skb->transport_header = skb->network_header + sizeof(*ipch);
__skb_pull(skb, sizeof(*ipch)); __skb_pull(skb, sizeof(*ipch));
err = ipcomp_decompress(x, skb); err = ipcomp_decompress(x, skb);
if (err) if (err)
goto out; goto out;
err = ipch->nexthdr; err = nexthdr;
out: out:
return err; return err;

5
net/ipv6/ipcomp6.c
View file

@ -64,6 +64,7 @@ static LIST_HEAD(ipcomp6_tfms_list);
static int ipcomp6_input(struct xfrm_state *x, struct sk_buff *skb) static int ipcomp6_input(struct xfrm_state *x, struct sk_buff *skb)
{ {
int nexthdr;
int err = -ENOMEM; int err = -ENOMEM;
struct ip_comp_hdr *ipch; struct ip_comp_hdr *ipch;
int plen, dlen; int plen, dlen;
@ -79,6 +80,8 @@ static int ipcomp6_input(struct xfrm_state *x, struct sk_buff *skb)
/* Remove ipcomp header and decompress original payload */ /* Remove ipcomp header and decompress original payload */
ipch = (void *)skb->data; ipch = (void *)skb->data;
nexthdr = ipch->nexthdr;
skb->transport_header = skb->network_header + sizeof(*ipch); skb->transport_header = skb->network_header + sizeof(*ipch);
__skb_pull(skb, sizeof(*ipch)); __skb_pull(skb, sizeof(*ipch));
@ -108,7 +111,7 @@ static int ipcomp6_input(struct xfrm_state *x, struct sk_buff *skb)
skb->truesize += dlen - plen; skb->truesize += dlen - plen;
__skb_put(skb, dlen - plen); __skb_put(skb, dlen - plen);
skb_copy_to_linear_data(skb, scratch, dlen); skb_copy_to_linear_data(skb, scratch, dlen);
err = ipch->nexthdr; err = nexthdr;
out_put_cpu: out_put_cpu:
put_cpu(); put_cpu();