diff options
| author | David S. Miller <davem@davemloft.net> | 2019-04-26 06:52:29 +0300 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2019-04-26 06:52:29 +0300 |
| commit | 8b4483658364f05b2e32845c8f445cdfd9452286 (patch) | |
| tree | 4734ef83378b1e90475ec4776ac72dfe16a7249b /net/ipv4/route.c | |
| parent | c049d56eb219661c9ae48d596c3e633973f89d1f (diff) | |
| parent | cd8dead0c39457e58ec1d36db93aedca811d48f1 (diff) | |
| download | linux-8b4483658364f05b2e32845c8f445cdfd9452286.tar.xz | |
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Two easy cases of overlapping changes.
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4/route.c')
| -rw-r--r-- | net/ipv4/route.c | 32 |
1 files changed, 23 insertions, 9 deletions
diff --git a/net/ipv4/route.c b/net/ipv4/route.c index d9b5aa2290d6..4950adeb05c0 100644 --- a/net/ipv4/route.c +++ b/net/ipv4/route.c @@ -1198,25 +1198,39 @@ static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie) return dst; } -static void ipv4_link_failure(struct sk_buff *skb) +static void ipv4_send_dest_unreach(struct sk_buff *skb) { struct ip_options opt; - struct rtable *rt; int res; /* Recompile ip options since IPCB may not be valid anymore. + * Also check we have a reasonable ipv4 header. */ - memset(&opt, 0, sizeof(opt)); - opt.optlen = ip_hdr(skb)->ihl*4 - sizeof(struct iphdr); + if (!pskb_network_may_pull(skb, sizeof(struct iphdr)) || + ip_hdr(skb)->version != 4 || ip_hdr(skb)->ihl < 5) + return; - rcu_read_lock(); - res = __ip_options_compile(dev_net(skb->dev), &opt, skb, NULL); - rcu_read_unlock(); + memset(&opt, 0, sizeof(opt)); + if (ip_hdr(skb)->ihl > 5) { + if (!pskb_network_may_pull(skb, ip_hdr(skb)->ihl * 4)) + return; + opt.optlen = ip_hdr(skb)->ihl * 4 - sizeof(struct iphdr); - if (res) - return; + rcu_read_lock(); + res = __ip_options_compile(dev_net(skb->dev), &opt, skb, NULL); + rcu_read_unlock(); + if (res) + return; + } __icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0, &opt); +} + +static void ipv4_link_failure(struct sk_buff *skb) +{ + struct rtable *rt; + + ipv4_send_dest_unreach(skb); rt = skb_rtable(skb); if (rt) |