xfrm4: Reload skb header pointers after calling pskb_may_pull.

A call to pskb_may_pull may change the pointers into the packet,
so reload the pointers after the call.

Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>

diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index e4d533c6c7963f2cfdeb6e1dfe6f1a5ee914bf86..269b137c87ec0026d553f0f655998418ea909e9a 100644 (file)
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -129,7 +129,10 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse)
                case IPPROTO_DCCP:
                        if (xprth + 4 < skb->data ||
                            pskb_may_pull(skb, xprth + 4 - skb->data)) {
-                               __be16 *ports = (__be16 *)xprth;
+                               __be16 *ports;
+
+                               xprth = skb_network_header(skb) + iph->ihl * 4;
+                               ports = (__be16 *)xprth;
 
                                fl4->fl4_sport = ports[!!reverse];
                                fl4->fl4_dport = ports[!reverse];
@@ -139,7 +142,10 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse)
                case IPPROTO_ICMP:
                        if (xprth + 2 < skb->data ||
                            pskb_may_pull(skb, xprth + 2 - skb->data)) {
-                               u8 *icmp = xprth;
+                               u8 *icmp;
+
+                               xprth = skb_network_header(skb) + iph->ihl * 4;
+                               icmp = xprth;
 
                                fl4->fl4_icmp_type = icmp[0];
                                fl4->fl4_icmp_code = icmp[1];
@@ -149,7 +155,10 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse)
                case IPPROTO_ESP:
                        if (xprth + 4 < skb->data ||
                            pskb_may_pull(skb, xprth + 4 - skb->data)) {
-                               __be32 *ehdr = (__be32 *)xprth;
+                               __be32 *ehdr;
+
+                               xprth = skb_network_header(skb) + iph->ihl * 4;
+                               ehdr = (__be32 *)xprth;
 
                                fl4->fl4_ipsec_spi = ehdr[0];
                        }
@@ -158,7 +167,10 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse)
                case IPPROTO_AH:
                        if (xprth + 8 < skb->data ||
                            pskb_may_pull(skb, xprth + 8 - skb->data)) {
-                               __be32 *ah_hdr = (__be32 *)xprth;
+                               __be32 *ah_hdr;
+
+                               xprth = skb_network_header(skb) + iph->ihl * 4;
+                               ah_hdr = (__be32 *)xprth;
 
                                fl4->fl4_ipsec_spi = ah_hdr[1];
                        }
@@ -167,7 +179,10 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse)
                case IPPROTO_COMP:
                        if (xprth + 4 < skb->data ||
                            pskb_may_pull(skb, xprth + 4 - skb->data)) {
-                               __be16 *ipcomp_hdr = (__be16 *)xprth;
+                               __be16 *ipcomp_hdr;
+
+                               xprth = skb_network_header(skb) + iph->ihl * 4;
+                               ipcomp_hdr = (__be16 *)xprth;
 
                                fl4->fl4_ipsec_spi = htonl(ntohs(ipcomp_hdr[1]));
                        }
@@ -176,8 +191,12 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse)
                case IPPROTO_GRE:
                        if (xprth + 12 < skb->data ||
                            pskb_may_pull(skb, xprth + 12 - skb->data)) {
-                               __be16 *greflags = (__be16 *)xprth;
-                               __be32 *gre_hdr = (__be32 *)xprth;
+                               __be16 *greflags;
+                               __be32 *gre_hdr;
+
+                               xprth = skb_network_header(skb) + iph->ihl * 4;
+                               greflags = (__be16 *)xprth;
+                               gre_hdr = (__be32 *)xprth;
 
                                if (greflags[0] & GRE_KEY) {
                                        if (greflags[0] & GRE_CSUM)