lkml.org 
[lkml]   [2017]   [Apr]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.18 004/145] ipv6: pointer math error in ip6_tnl_parse_tlv_enc_lim()
    Date
    3.18-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Dan Carpenter <dan.carpenter@oracle.com>


    [ Upstream commit 63117f09c768be05a0bf465911297dc76394f686 ]

    Casting is a high precedence operation but "off" and "i" are in terms of
    bytes so we need to have some parenthesis here.

    Fixes: fbfa743a9d2a ("ipv6: fix ip6_tnl_parse_tlv_enc_lim()")
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Acked-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/ipv6/ip6_tunnel.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/net/ipv6/ip6_tunnel.c
    +++ b/net/ipv6/ip6_tunnel.c
    @@ -448,7 +448,7 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct s
    if (i + sizeof(*tel) > optlen)
    break;

    - tel = (struct ipv6_tlv_tnl_enc_lim *) skb->data + off + i;
    + tel = (struct ipv6_tlv_tnl_enc_lim *)(skb->data + off + i);
    /* return index of option if found and valid */
    if (tel->type == IPV6_TLV_TNL_ENCAP_LIMIT &&
    tel->length == 1)

    \
     
     \ /
      Last update: 2017-04-16 13:19    [W:6.170 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site