bridge: Pull ip header into skb->data before looking into ip header. (Closes: #697903)
svn path=/dists/sid/linux/; revision=19754
This commit is contained in:
parent
546c19fa7c
commit
d8ca2ec22d
|
@ -91,6 +91,8 @@ linux (3.2.37-1) UNRELEASED; urgency=low
|
||||||
- sched: Queue RT tasks to head when prio drops
|
- sched: Queue RT tasks to head when prio drops
|
||||||
- sched: Consider pi boosting in setscheduler
|
- sched: Consider pi boosting in setscheduler
|
||||||
* [s390] s390/time: fix sched_clock() overflow (Closes: #698382)
|
* [s390] s390/time: fix sched_clock() overflow (Closes: #698382)
|
||||||
|
* bridge: Pull ip header into skb->data before looking into ip header.
|
||||||
|
(Closes: #697903)
|
||||||
|
|
||||||
[ Aurelien Jarno ]
|
[ Aurelien Jarno ]
|
||||||
* [armhf/vexpress] Add kernel udebs.
|
* [armhf/vexpress] Add kernel udebs.
|
||||||
|
|
30
debian/patches/bugfix/all/bridge-Pull-ip-header-into-skb-data-before-looking-i.patch
vendored
Normal file
30
debian/patches/bugfix/all/bridge-Pull-ip-header-into-skb-data-before-looking-i.patch
vendored
Normal file
|
@ -0,0 +1,30 @@
|
||||||
|
From: Sarveshwar Bandi <sarveshwar.bandi@emulex.com>
|
||||||
|
Date: Wed, 10 Oct 2012 01:15:01 +0000
|
||||||
|
Subject: bridge: Pull ip header into skb->data before looking into ip header.
|
||||||
|
|
||||||
|
commit 6caab7b0544e83e6c160b5e80f5a4a7dd69545c7 upstream.
|
||||||
|
|
||||||
|
If lower layer driver leaves the ip header in the skb fragment, it needs to
|
||||||
|
be first pulled into skb->data before inspecting ip header length or ip version
|
||||||
|
number.
|
||||||
|
|
||||||
|
Signed-off-by: Sarveshwar Bandi <sarveshwar.bandi@emulex.com>
|
||||||
|
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||||
|
---
|
||||||
|
net/bridge/br_netfilter.c | 3 +++
|
||||||
|
1 file changed, 3 insertions(+)
|
||||||
|
|
||||||
|
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
|
||||||
|
index 68e8f36..fe43bc7 100644
|
||||||
|
--- a/net/bridge/br_netfilter.c
|
||||||
|
+++ b/net/bridge/br_netfilter.c
|
||||||
|
@@ -265,6 +265,9 @@ static int br_parse_ip_options(struct sk_buff *skb)
|
||||||
|
struct net_device *dev = skb->dev;
|
||||||
|
u32 len;
|
||||||
|
|
||||||
|
+ if (!pskb_may_pull(skb, sizeof(struct iphdr)))
|
||||||
|
+ goto inhdr_error;
|
||||||
|
+
|
||||||
|
iph = ip_hdr(skb);
|
||||||
|
opt = &(IPCB(skb)->opt);
|
||||||
|
|
|
@ -467,3 +467,4 @@ bugfix/all/vt6656-Fix-inconsistent-structure-packing.patch
|
||||||
bugfix/all/fs-cachefiles-add-support-for-large-files-in-filesys.patch
|
bugfix/all/fs-cachefiles-add-support-for-large-files-in-filesys.patch
|
||||||
bugfix/x86/xen-Fix-stack-corruption-in-xen_failsafe_callback-fo.patch
|
bugfix/x86/xen-Fix-stack-corruption-in-xen_failsafe_callback-fo.patch
|
||||||
bugfix/s390/s390-time-fix-sched_clock-overflow.patch
|
bugfix/s390/s390-time-fix-sched_clock-overflow.patch
|
||||||
|
bugfix/all/bridge-Pull-ip-header-into-skb-data-before-looking-i.patch
|
||||||
|
|
Loading…
Reference in New Issue