/* * netsniff-ng - the packet sniffing beast * Copyright (C) 2012 Christoph Jaeger * Subject to the GPL, version 2. */ #ifndef PKT_BUFF_H #define PKT_BUFF_H #include "hash.h" #include "built_in.h" #include "proto.h" #include "xmalloc.h" struct pkt_buff { /* invariant: head <= data <= tail */ uint8_t *head; uint8_t *data; uint8_t *tail; unsigned int size; struct protocol *proto; }; static inline struct pkt_buff *pkt_alloc(uint8_t *packet, unsigned int len) { struct pkt_buff *pkt = xmalloc(sizeof(*pkt)); pkt->head = packet; pkt->data = packet; pkt->tail = packet + len; pkt->size = len; pkt->proto = NULL; return pkt; } static inline void pkt_free(struct pkt_buff *pkt) { xfree(pkt); } static inline unsigned int pkt_len(struct pkt_buff *pkt) { bug_on(!pkt || pkt->data > pkt->tail); return pkt->tail - pkt->data; } static inline uint8_t *pkt_pull(struct pkt_buff *pkt, unsigned int len) { uint8_t *data = NULL; bug_on(!pkt || pkt->head > pkt->data || pkt->data > pkt->tail); if (len <= pkt_len(pkt)) { data = pkt->data; pkt->data += len; } bug_on(!pkt || pkt->head > pkt->data || pkt->data > pkt->tail); return data; } static inline uint8_t *pkt_peek(struct pkt_buff *pkt) { bug_on(!pkt || pkt->head > pkt->data || pkt->data > pkt->tail); return pkt->data; } static inline unsigned int pkt_trim(struct pkt_buff *pkt, unsigned int len) { unsigned int ret = 0; bug_on(!pkt || pkt->head > pkt->data || pkt->data > pkt->tail); if (len <= pkt_len(pkt)) ret = len; pkt->tail -= ret; bug_on(!pkt || pkt->head > pkt->data || pkt->data > pkt->tail); return ret; } static inline uint8_t *pkt_pull_tail(struct pkt_buff *pkt, unsigned int len) { uint8_t *tail = NULL; bug_on(!pkt || pkt->head > pkt->data || pkt->data > pkt->tail); if (len <= pkt_len(pkt)) { tail = pkt->tail; pkt->tail -= len; } return tail; } static inline void pkt_set_proto(struct pkt_buff *pkt, struct hash_table *table, unsigned int key) { bug_on(!pkt || !table); pkt->proto = (struct protocol *) lookup_hash(key, table); while (pkt->proto && key != pkt->proto->key) pkt->proto = pkt->proto->next; } #endif /* PKT_BUFF_H */ ' action='/cgit.cgi/linux/net-next.git/log/'>
diff options
context:
space:
mode:
authorEric Dumazet <edumazet@google.com>2017-02-09 16:15:52 -0800
committerDavid S. Miller <davem@davemloft.net>2017-02-10 15:57:34 -0500
commit72fb96e7bdbbdd4421b0726992496531060f3636 (patch)
treeedd4c429c973566b233252d3d55343a2bea7c9e9
parent74470954857c264168d2b5a113904cf0cfd27d18 (diff)
l2tp: do not use udp_ioctl()
udp_ioctl(), as its name suggests, is used by UDP protocols, but is also used by L2TP :( L2TP should use its own handler, because it really does not look the same. SIOCINQ for instance should not assume UDP checksum or headers. Thanks to Andrey and syzkaller team for providing the report and a nice reproducer. While crashes only happen on recent kernels (after commit 7c13f97ffde6 ("udp: do fwd memory scheduling on dequeue")), this probably needs to be backported to older kernels. Fixes: 7c13f97ffde6 ("udp: do fwd memory scheduling on dequeue") Fixes: 85584672012e ("udp: Fix udp_poll() and ioctl()") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: Andrey Konovalov <andreyknvl@google.com> Acked-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat
-rw-r--r--net/l2tp/l2tp_core.h1
-rw-r--r--net/l2tp/l2tp_ip.c27
-rw-r--r--net/l2tp/l2tp_ip6.c2
3 files changed, 28 insertions, 2 deletions
diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h