Commit b0366486 authored by Bart De Schuymer's avatar Bart De Schuymer Committed by David S. Miller

[BRIDGE-NF]: Fix bridge-nf ipv6 length check

A typo caused some bridged IPv6 packets to get dropped randomly,
as reported by Sebastien Chaumontet. The patch below fixes this
(using skb->nh.raw instead of raw) and also makes the jumbo packet
length checking up-to-date with the code in
net/ipv6/exthdrs.c::ipv6_hop_jumbo.
Signed-off-by: default avatarBart De Schuymer <bdschuym@pandora.be>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 6b80ebed
...@@ -295,7 +295,7 @@ static int check_hbh_len(struct sk_buff *skb) ...@@ -295,7 +295,7 @@ static int check_hbh_len(struct sk_buff *skb)
len -= 2; len -= 2;
while (len > 0) { while (len > 0) {
int optlen = raw[off+1]+2; int optlen = skb->nh.raw[off+1]+2;
switch (skb->nh.raw[off]) { switch (skb->nh.raw[off]) {
case IPV6_TLV_PAD0: case IPV6_TLV_PAD0:
...@@ -308,18 +308,15 @@ static int check_hbh_len(struct sk_buff *skb) ...@@ -308,18 +308,15 @@ static int check_hbh_len(struct sk_buff *skb)
case IPV6_TLV_JUMBO: case IPV6_TLV_JUMBO:
if (skb->nh.raw[off+1] != 4 || (off&3) != 2) if (skb->nh.raw[off+1] != 4 || (off&3) != 2)
goto bad; goto bad;
pkt_len = ntohl(*(u32*)(skb->nh.raw+off+2)); pkt_len = ntohl(*(u32*)(skb->nh.raw+off+2));
if (pkt_len <= IPV6_MAXPLEN ||
skb->nh.ipv6h->payload_len)
goto bad;
if (pkt_len > skb->len - sizeof(struct ipv6hdr)) if (pkt_len > skb->len - sizeof(struct ipv6hdr))
goto bad; goto bad;
if (pkt_len + sizeof(struct ipv6hdr) < skb->len) { if (pskb_trim_rcsum(skb,
if (__pskb_trim(skb, pkt_len+sizeof(struct ipv6hdr)))
pkt_len + sizeof(struct ipv6hdr)))
goto bad; goto bad;
if (skb->ip_summed == CHECKSUM_HW)
skb->ip_summed = CHECKSUM_NONE;
}
break; break;
default: default:
if (optlen > len) if (optlen > len)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment