Commit 96f5a846 authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller

ip_gre: fix a possible crash in ipgre_err()

Another fix needed in ipgre_err(), as parse_gre_header() might change
skb->head.

Bug added in commit c5441932 (GRE: Refactor GRE tunneling code.)
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Cc: Pravin B Shelar <pshelar@nicira.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent b423e9ae
...@@ -235,7 +235,7 @@ static void ipgre_err(struct sk_buff *skb, u32 info) ...@@ -235,7 +235,7 @@ static void ipgre_err(struct sk_buff *skb, u32 info)
*/ */
struct net *net = dev_net(skb->dev); struct net *net = dev_net(skb->dev);
struct ip_tunnel_net *itn; struct ip_tunnel_net *itn;
const struct iphdr *iph = (const struct iphdr *)skb->data; const struct iphdr *iph;
const int type = icmp_hdr(skb)->type; const int type = icmp_hdr(skb)->type;
const int code = icmp_hdr(skb)->code; const int code = icmp_hdr(skb)->code;
struct ip_tunnel *t; struct ip_tunnel *t;
...@@ -281,6 +281,7 @@ static void ipgre_err(struct sk_buff *skb, u32 info) ...@@ -281,6 +281,7 @@ static void ipgre_err(struct sk_buff *skb, u32 info)
else else
itn = net_generic(net, ipgre_net_id); itn = net_generic(net, ipgre_net_id);
iph = (const struct iphdr *)skb->data;
t = ip_tunnel_lookup(itn, skb->dev->ifindex, tpi.flags, t = ip_tunnel_lookup(itn, skb->dev->ifindex, tpi.flags,
iph->daddr, iph->saddr, tpi.key); iph->daddr, iph->saddr, tpi.key);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment