diff options
author | Pravin B Shelar <pshelar@nicira.com> | 2013-09-25 12:57:47 -0400 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2013-09-30 15:05:07 -0400 |
commit | d4a71b155c12d0d429c6b69d94076d6d57e2a7a7 (patch) | |
tree | ef6a48cbbda948c321542dc13e66686a21998b00 /net | |
parent | 2d77f343343c4f38b8f94be1964bbbc6456a147f (diff) |
ip_tunnel: Do not use stale inner_iph pointer.
While sending packet skb_cow_head() can change skb header which
invalidates inner_iph pointer to skb header. Following patch
avoid using it. Found by code inspection.
This bug was introduced by commit 0e6fbc5b6c6218 (ip_tunnels: extend
iptunnel_xmit()).
Signed-off-by: Pravin B Shelar <pshelar@nicira.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r-- | net/ipv4/ip_tunnel.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c index ac9fabe0300f..d3fbad422e0e 100644 --- a/net/ipv4/ip_tunnel.c +++ b/net/ipv4/ip_tunnel.c | |||
@@ -623,6 +623,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, | |||
623 | tunnel->err_count = 0; | 623 | tunnel->err_count = 0; |
624 | } | 624 | } |
625 | 625 | ||
626 | tos = ip_tunnel_ecn_encap(tos, inner_iph, skb); | ||
626 | ttl = tnl_params->ttl; | 627 | ttl = tnl_params->ttl; |
627 | if (ttl == 0) { | 628 | if (ttl == 0) { |
628 | if (skb->protocol == htons(ETH_P_IP)) | 629 | if (skb->protocol == htons(ETH_P_IP)) |
@@ -651,8 +652,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, | |||
651 | } | 652 | } |
652 | 653 | ||
653 | err = iptunnel_xmit(rt, skb, fl4.saddr, fl4.daddr, protocol, | 654 | err = iptunnel_xmit(rt, skb, fl4.saddr, fl4.daddr, protocol, |
654 | ip_tunnel_ecn_encap(tos, inner_iph, skb), ttl, df, | 655 | tos, ttl, df, !net_eq(tunnel->net, dev_net(dev))); |
655 | !net_eq(tunnel->net, dev_net(dev))); | ||
656 | iptunnel_xmit_stats(err, &dev->stats, dev->tstats); | 656 | iptunnel_xmit_stats(err, &dev->stats, dev->tstats); |
657 | 657 | ||
658 | return; | 658 | return; |