diff options
| author | Miaohe Lin <linmiaohe@huawei.com> | 2020-08-15 11:44:31 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-09-03 12:22:23 +0300 |
| commit | 5d28f39d847e75678901d9bb1f18a4cbd8bd7e60 (patch) | |
| tree | 8d0f60d90e7970aadc40cfa4c30b6f5d23615173 /net/core | |
| parent | 8d3dc7f94175c4a457e88a06ad871fc3e7bbfbe2 (diff) | |
| download | linux-5d28f39d847e75678901d9bb1f18a4cbd8bd7e60.tar.xz | |
net: Fix potential wrong skb->protocol in skb_vlan_untag()
[ Upstream commit 55eff0eb7460c3d50716ed9eccf22257b046ca92 ]
We may access the two bytes after vlan_hdr in vlan_set_encap_proto(). So
we should pull VLAN_HLEN + sizeof(unsigned short) in skb_vlan_untag() or
we may access the wrong data.
Fixes: 0d5501c1c828 ("net: Always untag vlan-tagged traffic on input.")
Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net/core')
| -rw-r--r-- | net/core/skbuff.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/net/core/skbuff.c b/net/core/skbuff.c index b1933e1f3aef..4c0f637bbf8b 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -5053,8 +5053,8 @@ struct sk_buff *skb_vlan_untag(struct sk_buff *skb) skb = skb_share_check(skb, GFP_ATOMIC); if (unlikely(!skb)) goto err_free; - - if (unlikely(!pskb_may_pull(skb, VLAN_HLEN))) + /* We may access the two bytes after vlan_hdr in vlan_set_encap_proto(). */ + if (unlikely(!pskb_may_pull(skb, VLAN_HLEN + sizeof(unsigned short)))) goto err_free; vhdr = (struct vlan_hdr *)skb->data; |