diff options
| author | Toke Høiland-Jørgensen | 2019-04-04 15:01:33 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman | 2019-04-27 09:36:32 +0200 |
| commit | cbce0413f783a5a9d49005a2187201df8eb15a38 (patch) | |
| tree | c22359a33bc49057c8a50fb562335abbfaa050a9 /net/sched | |
| parent | sch_cake: Use tc_skb_protocol() helper for getting packet protocol (diff) | |
| download | kernel-qcow2-linux-cbce0413f783a5a9d49005a2187201df8eb15a38.tar.gz kernel-qcow2-linux-cbce0413f783a5a9d49005a2187201df8eb15a38.tar.xz kernel-qcow2-linux-cbce0413f783a5a9d49005a2187201df8eb15a38.zip | |
sch_cake: Make sure we can write the IP header before changing DSCP bits
[ Upstream commit c87b4ecdbe8db27867a7b7f840291cd843406bd7 ]
There is not actually any guarantee that the IP headers are valid before we
access the DSCP bits of the packets. Fix this using the same approach taken
in sch_dsmark.
Reported-by: Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>
Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net/sched')
| -rw-r--r-- | net/sched/sch_cake.c | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c index c5e87d1c26eb..75ca80909cf8 100644 --- a/net/sched/sch_cake.c +++ b/net/sched/sch_cake.c @@ -1524,16 +1524,27 @@ static void cake_wash_diffserv(struct sk_buff *skb) static u8 cake_handle_diffserv(struct sk_buff *skb, u16 wash) { + int wlen = skb_network_offset(skb); u8 dscp; switch (tc_skb_protocol(skb)) { case htons(ETH_P_IP): + wlen += sizeof(struct iphdr); + if (!pskb_may_pull(skb, wlen) || + skb_try_make_writable(skb, wlen)) + return 0; + dscp = ipv4_get_dsfield(ip_hdr(skb)) >> 2; if (wash && dscp) ipv4_change_dsfield(ip_hdr(skb), INET_ECN_MASK, 0); return dscp; case htons(ETH_P_IPV6): + wlen += sizeof(struct ipv6hdr); + if (!pskb_may_pull(skb, wlen) || + skb_try_make_writable(skb, wlen)) + return 0; + dscp = ipv6_get_dsfield(ipv6_hdr(skb)) >> 2; if (wash && dscp) ipv6_change_dsfield(ipv6_hdr(skb), INET_ECN_MASK, 0); |