]> git.itanic.dy.fi Git - linux-stable/commit
gre: refetch erspan header from skb->data after pskb_may_pull()
authorCong Wang <xiyou.wangcong@gmail.com>
Fri, 6 Dec 2019 03:39:02 +0000 (19:39 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 18 Dec 2019 15:08:51 +0000 (16:08 +0100)
commit23fbdd5d1e826454a1ce199e716e2015033212c4
tree65abe1b24874900c2fe690bb2b67e55433e59d95
parent71bc12b1fb4afedf52d558a2cfb351f68831caeb
gre: refetch erspan header from skb->data after pskb_may_pull()

[ Upstream commit 0e4940928c26527ce8f97237fef4c8a91cd34207 ]

After pskb_may_pull() we should always refetch the header
pointers from the skb->data in case it got reallocated.

In gre_parse_header(), the erspan header is still fetched
from the 'options' pointer which is fetched before
pskb_may_pull().

Found this during code review of a KMSAN bug report.

Fixes: cb73ee40b1b3 ("net: ip_gre: use erspan key field for tunnel lookup")
Cc: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Acked-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
Acked-by: William Tu <u9012063@gmail.com>
Reviewed-by: Simon Horman <simon.horman@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/ipv4/gre_demux.c