Commit f2f00981 authored by Changli Gao's avatar Changli Gao Committed by David S. Miller

sch_sfq: add sanity check for the packet length

The packet length should be checked before the packet data is dereferenced.
Signed-off-by: default avatarChangli Gao <xiaosuo@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 12dc96d1
...@@ -122,7 +122,11 @@ static unsigned sfq_hash(struct sfq_sched_data *q, struct sk_buff *skb) ...@@ -122,7 +122,11 @@ static unsigned sfq_hash(struct sfq_sched_data *q, struct sk_buff *skb)
switch (skb->protocol) { switch (skb->protocol) {
case htons(ETH_P_IP): case htons(ETH_P_IP):
{ {
const struct iphdr *iph = ip_hdr(skb); const struct iphdr *iph;
if (!pskb_network_may_pull(skb, sizeof(*iph)))
goto err;
iph = ip_hdr(skb);
h = (__force u32)iph->daddr; h = (__force u32)iph->daddr;
h2 = (__force u32)iph->saddr ^ iph->protocol; h2 = (__force u32)iph->saddr ^ iph->protocol;
if (!(iph->frag_off&htons(IP_MF|IP_OFFSET)) && if (!(iph->frag_off&htons(IP_MF|IP_OFFSET)) &&
...@@ -131,25 +135,32 @@ static unsigned sfq_hash(struct sfq_sched_data *q, struct sk_buff *skb) ...@@ -131,25 +135,32 @@ static unsigned sfq_hash(struct sfq_sched_data *q, struct sk_buff *skb)
iph->protocol == IPPROTO_UDPLITE || iph->protocol == IPPROTO_UDPLITE ||
iph->protocol == IPPROTO_SCTP || iph->protocol == IPPROTO_SCTP ||
iph->protocol == IPPROTO_DCCP || iph->protocol == IPPROTO_DCCP ||
iph->protocol == IPPROTO_ESP)) iph->protocol == IPPROTO_ESP) &&
pskb_network_may_pull(skb, iph->ihl * 4 + 4))
h2 ^= *(((u32*)iph) + iph->ihl); h2 ^= *(((u32*)iph) + iph->ihl);
break; break;
} }
case htons(ETH_P_IPV6): case htons(ETH_P_IPV6):
{ {
struct ipv6hdr *iph = ipv6_hdr(skb); struct ipv6hdr *iph;
if (!pskb_network_may_pull(skb, sizeof(*iph)))
goto err;
iph = ipv6_hdr(skb);
h = (__force u32)iph->daddr.s6_addr32[3]; h = (__force u32)iph->daddr.s6_addr32[3];
h2 = (__force u32)iph->saddr.s6_addr32[3] ^ iph->nexthdr; h2 = (__force u32)iph->saddr.s6_addr32[3] ^ iph->nexthdr;
if (iph->nexthdr == IPPROTO_TCP || if ((iph->nexthdr == IPPROTO_TCP ||
iph->nexthdr == IPPROTO_UDP || iph->nexthdr == IPPROTO_UDP ||
iph->nexthdr == IPPROTO_UDPLITE || iph->nexthdr == IPPROTO_UDPLITE ||
iph->nexthdr == IPPROTO_SCTP || iph->nexthdr == IPPROTO_SCTP ||
iph->nexthdr == IPPROTO_DCCP || iph->nexthdr == IPPROTO_DCCP ||
iph->nexthdr == IPPROTO_ESP) iph->nexthdr == IPPROTO_ESP) &&
pskb_network_may_pull(skb, sizeof(*iph) + 4))
h2 ^= *(u32*)&iph[1]; h2 ^= *(u32*)&iph[1];
break; break;
} }
default: default:
err:
h = (unsigned long)skb_dst(skb) ^ (__force u32)skb->protocol; h = (unsigned long)skb_dst(skb) ^ (__force u32)skb->protocol;
h2 = (unsigned long)skb->sk; h2 = (unsigned long)skb->sk;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment