diff options
| author | Pravin B Shelar <pshelar@nicira.com> | 2015-09-28 17:24:25 -0700 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2015-11-17 15:54:46 +0000 |
| commit | a5e14d9fd0d6c7696207e95468ef01f790556a29 (patch) | |
| tree | 9f0666669bc6fe5378bd2c466273f166a5a52072 | |
| parent | c3321c4eafd33e3fda7a267776a9be6c2b5043f6 (diff) | |
| download | lwn-a5e14d9fd0d6c7696207e95468ef01f790556a29.tar.gz lwn-a5e14d9fd0d6c7696207e95468ef01f790556a29.zip | |
skbuff: Fix skb checksum partial check.
[ Upstream commit 31b33dfb0a144469dd805514c9e63f4993729a48 ]
Earlier patch 6ae459bda tried to detect void ckecksum partial
skb by comparing pull length to checksum offset. But it does
not work for all cases since checksum-offset depends on
updates to skb->data.
Following patch fixes it by validating checksum start offset
after skb-data pointer is updated. Negative value of checksum
offset start means there is no need to checksum.
Fixes: 6ae459bda ("skbuff: Fix skb checksum flag on skb pull")
Reported-by: Andrew Vagin <avagin@odin.com>
Signed-off-by: Pravin B Shelar <pshelar@nicira.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
| -rw-r--r-- | include/linux/skbuff.h | 2 | ||||
| -rw-r--r-- | net/core/skbuff.c | 9 |
2 files changed, 6 insertions, 5 deletions
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index cd3cbd4a1a64..d0c9e6da90f7 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -2046,7 +2046,7 @@ static inline void skb_postpull_rcsum(struct sk_buff *skb, if (skb->ip_summed == CHECKSUM_COMPLETE) skb->csum = csum_sub(skb->csum, csum_partial(start, len, 0)); else if (skb->ip_summed == CHECKSUM_PARTIAL && - skb_checksum_start_offset(skb) <= len) + skb_checksum_start_offset(skb) < 0) skb->ip_summed = CHECKSUM_NONE; } diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 7121d9b59bbd..b30d9c2fd5bd 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -2579,11 +2579,12 @@ EXPORT_SYMBOL(skb_append_datato_frags); */ unsigned char *skb_pull_rcsum(struct sk_buff *skb, unsigned int len) { + unsigned char *data = skb->data; + BUG_ON(len > skb->len); - skb->len -= len; - BUG_ON(skb->len < skb->data_len); - skb_postpull_rcsum(skb, skb->data, len); - return skb->data += len; + __skb_pull(skb, len); + skb_postpull_rcsum(skb, data, len); + return skb->data; } EXPORT_SYMBOL_GPL(skb_pull_rcsum); |