lkml.org 
[lkml]   [2017]   [Mar]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 355/370] ipv6: pointer math error in ip6_tnl_parse_tlv_enc_lim()
    3.16.42-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Dan Carpenter <dan.carpenter@oracle.com>

    [ Upstream commit 63117f09c768be05a0bf465911297dc76394f686 ]

    Casting is a high precedence operation but "off" and "i" are in terms of
    bytes so we need to have some parenthesis here.

    Fixes: fbfa743a9d2a ("ipv6: fix ip6_tnl_parse_tlv_enc_lim()")
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Acked-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    net/ipv6/ip6_tunnel.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/net/ipv6/ip6_tunnel.c
    +++ b/net/ipv6/ip6_tunnel.c
    @@ -443,7 +443,7 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct s
    if (i + sizeof(*tel) > optlen)
    break;

    - tel = (struct ipv6_tlv_tnl_enc_lim *) skb->data + off + i;
    + tel = (struct ipv6_tlv_tnl_enc_lim *)(skb->data + off + i);
    /* return index of option if found and valid */
    if (tel->type == IPV6_TLV_TNL_ENCAP_LIMIT &&
    tel->length == 1)
    \
     
     \ /
      Last update: 2017-03-10 14:21    [W:4.173 / U:0.140 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site