rxrpc: rxkad: Don't use pskb_pull() to advance through the response packet
authorDavid Howells <dhowells@redhat.com>
Tue, 29 Sep 2020 20:48:50 +0000 (21:48 +0100)
committerDavid Howells <dhowells@redhat.com>
Mon, 23 Nov 2020 18:09:30 +0000 (18:09 +0000)
In the rxkad security class, don't use pskb_pull() to advance through the
contents of the response packet.  There's no point, especially as the next
and last access to the skbuff still has to allow for the wire header in the
offset (which we didn't advance over).

Better to just add the displacement to the next offset.

Signed-off-by: David Howells <dhowells@redhat.com>
net/rxrpc/rxkad.c

index f3182edfcbaecacc8b6940a48a856fa9d3ecf914..e5b4bbdd0f34d6507da89020bc014ba02fec06e1 100644 (file)
@@ -1162,8 +1162,6 @@ static int rxkad_verify_response(struct rxrpc_connection *conn,
        if (skb_copy_bits(skb, sizeof(struct rxrpc_wire_header),
                          response, sizeof(*response)) < 0)
                goto protocol_error;
-       if (!pskb_pull(skb, sizeof(*response)))
-               BUG();
 
        version = ntohl(response->version);
        ticket_len = ntohl(response->ticket_len);
@@ -1194,7 +1192,7 @@ static int rxkad_verify_response(struct rxrpc_connection *conn,
 
        eproto = tracepoint_string("rxkad_tkt_short");
        abort_code = RXKADPACKETSHORT;
-       if (skb_copy_bits(skb, sizeof(struct rxrpc_wire_header),
+       if (skb_copy_bits(skb, sizeof(struct rxrpc_wire_header) + sizeof(*response),
                          ticket, ticket_len) < 0)
                goto protocol_error_free;