Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 59cae009 authored by Wei Yongjun's avatar Wei Yongjun Committed by David S. Miller
Browse files

xfrm6: fix the proto and ports decode of sctp protocol 



The SCTP pushed the skb above the sctp chunk header, so the
check of pskb_may_pull(skb, nh + offset + 1 - skb->data) in
_decode_session6() will never return 0 and the ports decode
of sctp will always fail. (nh + offset + 1 - skb->data < 0)

Signed-off-by: default avatarWei Yongjun <yjwei@cn.fujitsu.com>
Acked-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent c615c9f3

net/ipv6/xfrm6_policy.c

+4 −2
Original line number Diff line number Diff line
@@ -157,7 +157,8 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse) 
	ipv6_addr_copy(&fl->fl6_dst, reverse ? &hdr->saddr : &hdr->daddr);

	ipv6_addr_copy(&fl->fl6_src, reverse ? &hdr->daddr : &hdr->saddr);



	while (pskb_may_pull(skb, nh + offset + 1 - skb->data)) {

	while (nh + offset + 1 < skb->data ||

	       pskb_may_pull(skb, nh + offset + 1 - skb->data)) {

		nh = skb_network_header(skb);

		exthdr = (struct ipv6_opt_hdr *)(nh + offset);
@@ -177,7 +178,8 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse) 
		case IPPROTO_TCP:

		case IPPROTO_SCTP:

		case IPPROTO_DCCP:

			if (!onlyproto && pskb_may_pull(skb, nh + offset + 4 - skb->data)) {

			if (!onlyproto && (nh + offset + 4 < skb->data ||

			     pskb_may_pull(skb, nh + offset + 4 - skb->data))) {

				__be16 *ports = (__be16 *)exthdr;



				fl->fl_ip_sport = ports[!!reverse];