From bbcf467dab42ea3c85f368df346c82af2fbba665 Mon Sep 17 00:00:00 2001 From: Herbert Xu Date: Mon, 3 Jul 2006 19:38:35 -0700 Subject: [NET]: Verify gso_type too in gso_segment We don't want nasty Xen guests to pass a TCPv6 packet in with gso_type set to TCPv4 or even UDP (or a packet that's both TCP and UDP). Signed-off-by: Herbert Xu Signed-off-by: David S. Miller --- net/ipv6/ipv6_sockglue.c | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'net/ipv6') diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c index c28e5c28744..ec59344478d 100644 --- a/net/ipv6/ipv6_sockglue.c +++ b/net/ipv6/ipv6_sockglue.c @@ -64,6 +64,14 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb, int features) struct inet6_protocol *ops; int proto; + if (unlikely(skb_shinfo(skb)->gso_type & + ~(SKB_GSO_UDP | + SKB_GSO_DODGY | + SKB_GSO_TCP_ECN | + SKB_GSO_TCPV6 | + 0))) + goto out; + if (unlikely(!pskb_may_pull(skb, sizeof(*ipv6h)))) goto out; -- cgit v1.2.3-70-g09d2 From 6703931c546e6dec0431776fa616d5accd3e7162 Mon Sep 17 00:00:00 2001 From: Michael Chan Date: Mon, 3 Jul 2006 19:41:11 -0700 Subject: [IPV6]: Fix ipv6 GSO payload length Fix ipv6 GSO payload length calculation. The ipv6 payload length excludes the ipv6 base header length and so must be subtracted. Signed-off-by: Michael Chan Signed-off-by: David S. Miller --- net/ipv6/ipv6_sockglue.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'net/ipv6') diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c index ec59344478d..0c17dec11c8 100644 --- a/net/ipv6/ipv6_sockglue.c +++ b/net/ipv6/ipv6_sockglue.c @@ -119,7 +119,8 @@ unlock: for (skb = segs; skb; skb = skb->next) { ipv6h = skb->nh.ipv6h; - ipv6h->payload_len = htons(skb->len - skb->mac_len); + ipv6h->payload_len = htons(skb->len - skb->mac_len - + sizeof(*ipv6h)); } out: -- cgit v1.2.3-70-g09d2 From 4bdbf6c033ba05bff65f69989baccd7103c5a530 Mon Sep 17 00:00:00 2001 From: Randy Dunlap Date: Mon, 3 Jul 2006 19:47:27 -0700 Subject: [NET]: add+use poison defines Add and use poison defines in net/. Signed-off-by: Randy Dunlap Signed-off-by: David S. Miller --- include/linux/poison.h | 4 ++++ net/atm/clip.c | 3 ++- net/ipv6/netfilter/ip6_tables.c | 3 ++- 3 files changed, 8 insertions(+), 2 deletions(-) (limited to 'net/ipv6') diff --git a/include/linux/poison.h b/include/linux/poison.h index a5347c02432..05d7d0fd6bd 100644 --- a/include/linux/poison.h +++ b/include/linux/poison.h @@ -45,6 +45,10 @@ /********** drivers/atm/ **********/ #define ATM_POISON_FREE 0x12 +/********** net/ **********/ +#define NEIGHBOR_DEAD 0xdeadbeef +#define NETFILTER_LINK_POISON 0xdead57ac + /********** kernel/mutexes **********/ #define MUTEX_DEBUG_INIT 0x11 #define MUTEX_DEBUG_FREE 0x22 diff --git a/net/atm/clip.c b/net/atm/clip.c index 87a454f5c89..121bf6f4914 100644 --- a/net/atm/clip.c +++ b/net/atm/clip.c @@ -23,6 +23,7 @@ #include /* for IFF_UP */ #include #include +#include #include #include #include @@ -266,7 +267,7 @@ static void clip_neigh_destroy(struct neighbour *neigh) DPRINTK("clip_neigh_destroy (neigh %p)\n", neigh); if (NEIGH2ENTRY(neigh)->vccs) printk(KERN_CRIT "clip_neigh_destroy: vccs != NULL !!!\n"); - NEIGH2ENTRY(neigh)->vccs = (void *) 0xdeadbeef; + NEIGH2ENTRY(neigh)->vccs = (void *) NEIGHBOR_DEAD; } static void clip_neigh_solicit(struct neighbour *neigh, struct sk_buff *skb) diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c index 7ef143c0ebf..f26898b0034 100644 --- a/net/ipv6/netfilter/ip6_tables.c +++ b/net/ipv6/netfilter/ip6_tables.c @@ -25,6 +25,7 @@ #include #include #include +#include #include #include #include @@ -376,7 +377,7 @@ ip6t_do_table(struct sk_buff **pskb, } while (!hotdrop); #ifdef CONFIG_NETFILTER_DEBUG - ((struct ip6t_entry *)table_base)->comefrom = 0xdead57ac; + ((struct ip6t_entry *)table_base)->comefrom = NETFILTER_LINK_POISON; #endif read_unlock_bh(&table->lock); -- cgit v1.2.3-70-g09d2