ah: reload pointers to skb data after calling skb_cow_data()

skb_cow_data() may allocate a new data buffer, so pointers on
skb should be set after this function.

Bug was introduced by commit dff3bb06 ("ah4: convert to ahash")
and 8631e9bd ("ah6: convert to ahash").

Signed-off-by: Wang Xuefu <xuefu.wang@6wind.com>
Acked-by: Krzysztof Witek <krzysztof.witek@6wind.com>
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
index 880a5ec6dce0e35805aa5abfb4a4cc4809698579..86961bec70abbdda253b68da69ba6780ece39726 100644 (file)
--- a/net/ipv4/ah4.c
+++ b/net/ipv4/ah4.c
@@ -314,14 +314,15 @@ static int ah_input(struct xfrm_state *x, struct sk_buff *skb)
 
        skb->ip_summed = CHECKSUM_NONE;
 
-       ah = (struct ip_auth_hdr *)skb->data;
-       iph = ip_hdr(skb);
-       ihl = ip_hdrlen(skb);
 
        if ((err = skb_cow_data(skb, 0, &trailer)) < 0)
                goto out;
        nfrags = err;
 
+       ah = (struct ip_auth_hdr *)skb->data;
+       iph = ip_hdr(skb);
+       ihl = ip_hdrlen(skb);
+
        work_iph = ah_alloc_tmp(ahash, nfrags, ihl + ahp->icv_trunc_len);
        if (!work_iph)
                goto out;

diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index ee82d4ef26ce8d81146bf769572dbf4d728a9bf3..1aba54ae53c443481dd2b2d7e0a5f1b2f573bdaa 100644 (file)
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -538,14 +538,16 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
        if (!pskb_may_pull(skb, ah_hlen))
                goto out;
 
-       ip6h = ipv6_hdr(skb);
-
-       skb_push(skb, hdr_len);
 
        if ((err = skb_cow_data(skb, 0, &trailer)) < 0)
                goto out;
        nfrags = err;
 
+       ah = (struct ip_auth_hdr *)skb->data;
+       ip6h = ipv6_hdr(skb);
+
+       skb_push(skb, hdr_len);
+
        work_iph = ah_alloc_tmp(ahash, nfrags, hdr_len + ahp->icv_trunc_len);
        if (!work_iph)
                goto out;