diff options
| author | Toke Høiland-Jørgensen <toke@redhat.com> | 2019-04-04 15:01:33 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-04-27 09:37:35 +0200 |
| commit | d58923dac952107bcfe0fe0ad59e80d3c952cc36 (patch) | |
| tree | 744503eb8ebeeacd81a488346e0fdf0653d043d3 /net | |
| parent | 064290d0f6c7adc4fa19f88e33bbb9f2633984fc (diff) | |
| download | linux-d58923dac952107bcfe0fe0ad59e80d3c952cc36.tar.gz linux-d58923dac952107bcfe0fe0ad59e80d3c952cc36.tar.bz2 linux-d58923dac952107bcfe0fe0ad59e80d3c952cc36.zip | |
sch_cake: Make sure we can write the IP header before changing DSCP bits
[ Upstream commit c87b4ecdbe8db27867a7b7f840291cd843406bd7 ]
There is not actually any guarantee that the IP headers are valid before we
access the DSCP bits of the packets. Fix this using the same approach taken
in sch_dsmark.
Reported-by: Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>
Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/sched/sch_cake.c | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c index c55fd5c932d4..9a1b0a93534d 100644 --- a/net/sched/sch_cake.c +++ b/net/sched/sch_cake.c @@ -1524,16 +1524,27 @@ static void cake_wash_diffserv(struct sk_buff *skb) static u8 cake_handle_diffserv(struct sk_buff *skb, u16 wash) { + int wlen = skb_network_offset(skb); u8 dscp; switch (tc_skb_protocol(skb)) { case htons(ETH_P_IP): + wlen += sizeof(struct iphdr); + if (!pskb_may_pull(skb, wlen) || + skb_try_make_writable(skb, wlen)) + return 0; + dscp = ipv4_get_dsfield(ip_hdr(skb)) >> 2; if (wash && dscp) ipv4_change_dsfield(ip_hdr(skb), INET_ECN_MASK, 0); return dscp; case htons(ETH_P_IPV6): + wlen += sizeof(struct ipv6hdr); + if (!pskb_may_pull(skb, wlen) || + skb_try_make_writable(skb, wlen)) + return 0; + dscp = ipv6_get_dsfield(ipv6_hdr(skb)) >> 2; if (wash && dscp) ipv6_change_dsfield(ipv6_hdr(skb), INET_ECN_MASK, 0); |