]> git.proxmox.com Git - mirror_ubuntu-kernels.git/commitdiff
ah: Read nexthdr value before overwriting it in ahash input callback.
authorNick Bowler <nbowler@elliptictech.com>
Tue, 8 Nov 2011 12:12:45 +0000 (12:12 +0000)
committerDavid S. Miller <davem@davemloft.net>
Wed, 9 Nov 2011 20:55:53 +0000 (15:55 -0500)
The AH4/6 ahash input callbacks read out the nexthdr field from the AH
header *after* they overwrite that header.  This is obviously not going
to end well.  Fix it up.

Signed-off-by: Nick Bowler <nbowler@elliptictech.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/ipv4/ah4.c
net/ipv6/ah6.c

index 33ca18603e3bdb73bb762355d97e226fbc6fa311..c7056b2e831f6d107c3d1aaa993b3b2b6b23f2d1 100644 (file)
@@ -262,12 +262,12 @@ static void ah_input_done(struct crypto_async_request *base, int err)
        if (err)
                goto out;
 
+       err = ah->nexthdr;
+
        skb->network_header += ah_hlen;
        memcpy(skb_network_header(skb), work_iph, ihl);
        __skb_pull(skb, ah_hlen + ihl);
        skb_set_transport_header(skb, -ihl);
-
-       err = ah->nexthdr;
 out:
        kfree(AH_SKB_CB(skb)->tmp);
        xfrm_input_resume(skb, err);
index ede4d9d6cc2b6cd6e94dadcc7a17f4ef3d27a4b8..7a33aaa0022785734a22f7d279e187f65b8072b4 100644 (file)
@@ -464,12 +464,12 @@ static void ah6_input_done(struct crypto_async_request *base, int err)
        if (err)
                goto out;
 
+       err = ah->nexthdr;
+
        skb->network_header += ah_hlen;
        memcpy(skb_network_header(skb), work_iph, hdr_len);
        __skb_pull(skb, ah_hlen + hdr_len);
        skb_set_transport_header(skb, -hdr_len);
-
-       err = ah->nexthdr;
 out:
        kfree(AH_SKB_CB(skb)->tmp);
        xfrm_input_resume(skb, err);