diff options
| author | Thomas Graf <tgraf@suug.ch> | 2006-03-07 14:56:12 -0800 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2006-03-07 14:56:12 -0800 |
| commit | 850a9a4e3c019ce67e3bc29c810ac213ec4c169e (patch) | |
| tree | e5ecac1ef9c88cdfabea26de440158b526afbe8a /net | |
| parent | d0b004840bd3b5ff2f2a0ad14fa0bd43349f5175 (diff) | |
| download | kernel_goldelico_gta04-850a9a4e3c019ce67e3bc29c810ac213ec4c169e.zip kernel_goldelico_gta04-850a9a4e3c019ce67e3bc29c810ac213ec4c169e.tar.gz kernel_goldelico_gta04-850a9a4e3c019ce67e3bc29c810ac213ec4c169e.tar.bz2 | |
[NETFILTER] ip_queue: Fix wrong skb->len == nlmsg_len assumption
The size of the skb carrying the netlink message is not
equivalent to the length of the actual netlink message
due to padding. ip_queue matches the length of the payload
against the original packet size to determine if packet
mangling is desired, due to the above wrong assumption
arbitary packets may not be mangled depening on their
original size.
Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
| -rw-r--r-- | net/ipv4/netfilter/ip_queue.c | 2 | ||||
| -rw-r--r-- | net/ipv6/netfilter/ip6_queue.c | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c index 36339eb..08f80e2 100644 --- a/net/ipv4/netfilter/ip_queue.c +++ b/net/ipv4/netfilter/ip_queue.c @@ -524,7 +524,7 @@ ipq_rcv_skb(struct sk_buff *skb) write_unlock_bh(&queue_lock); status = ipq_receive_peer(NLMSG_DATA(nlh), type, - skblen - NLMSG_LENGTH(0)); + nlmsglen - NLMSG_LENGTH(0)); if (status < 0) RCV_SKB_FAIL(status); diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c index 5027bbe..af06350 100644 --- a/net/ipv6/netfilter/ip6_queue.c +++ b/net/ipv6/netfilter/ip6_queue.c @@ -522,7 +522,7 @@ ipq_rcv_skb(struct sk_buff *skb) write_unlock_bh(&queue_lock); status = ipq_receive_peer(NLMSG_DATA(nlh), type, - skblen - NLMSG_LENGTH(0)); + nlmsglen - NLMSG_LENGTH(0)); if (status < 0) RCV_SKB_FAIL(status); |