summaryrefslogtreecommitdiff
path: root/net
diff options
context:
space:
mode:
authorNick Bowler <nbowler@elliptictech.com>2011-11-08 16:12:45 +0400
committerDavid S. Miller <davem@davemloft.net>2011-11-10 00:55:53 +0400
commitb7ea81a58adc123a4e980cb0eff9eb5c144b5dc7 (patch)
tree4f4b2aeef8f66763cc48dccb7aef505f96601047 /net
parent069294e813ed5f27f82613b027609bcda5f1b914 (diff)
downloadlinux-b7ea81a58adc123a4e980cb0eff9eb5c144b5dc7.tar.xz
ah: Read nexthdr value before overwriting it in ahash input callback.
The AH4/6 ahash input callbacks read out the nexthdr field from the AH header *after* they overwrite that header. This is obviously not going to end well. Fix it up. Signed-off-by: Nick Bowler <nbowler@elliptictech.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r--net/ipv4/ah4.c4
-rw-r--r--net/ipv6/ah6.c4
2 files changed, 4 insertions, 4 deletions
diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
index 33ca18603e3b..c7056b2e831f 100644
--- a/net/ipv4/ah4.c
+++ b/net/ipv4/ah4.c
@@ -262,12 +262,12 @@ static void ah_input_done(struct crypto_async_request *base, int err)
if (err)
goto out;
+ err = ah->nexthdr;
+
skb->network_header += ah_hlen;
memcpy(skb_network_header(skb), work_iph, ihl);
__skb_pull(skb, ah_hlen + ihl);
skb_set_transport_header(skb, -ihl);
-
- err = ah->nexthdr;
out:
kfree(AH_SKB_CB(skb)->tmp);
xfrm_input_resume(skb, err);
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index ede4d9d6cc2b..7a33aaa00227 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -464,12 +464,12 @@ static void ah6_input_done(struct crypto_async_request *base, int err)
if (err)
goto out;
+ err = ah->nexthdr;
+
skb->network_header += ah_hlen;
memcpy(skb_network_header(skb), work_iph, hdr_len);
__skb_pull(skb, ah_hlen + hdr_len);
skb_set_transport_header(skb, -hdr_len);
-
- err = ah->nexthdr;
out:
kfree(AH_SKB_CB(skb)->tmp);
xfrm_input_resume(skb, err);