Merge "net: qualcomm: rmnet: validate ipv6 extension header lengths" (e3e20132) · Commits · e / devices / android_kernel_fairphone_FP4

drivers/net/ethernet/qualcomm/rmnet/rmnet_descriptor.c

+9 −2

Original line number	Diff line number	Diff line
		// SPDX-License-Identifier: GPL-2.0-only
		/* Copyright (c) 2013-2019, The Linux Foundation. All rights reserved.
		/* Copyright (c) 2013-2020, The Linux Foundation. All rights reserved.
		*
		* RMNET Packet Descriptor Framework
		*
		@@ -95,6 +95,7 @@ EXPORT_SYMBOL(rmnet_descriptor_add_frag);
		int rmnet_frag_ipv6_skip_exthdr(struct rmnet_frag_descriptor *frag_desc,
		int start, u8 nexthdrp, __be16 fragp)
		{
		u32 frag_size = skb_frag_size(&frag_desc->frag);
		u8 nexthdr = *nexthdrp;

		*fragp = 0;
		@@ -106,11 +107,17 @@ int rmnet_frag_ipv6_skip_exthdr(struct rmnet_frag_descriptor *frag_desc,
		if (nexthdr == NEXTHDR_NONE)
		return -EINVAL;

		hp = rmnet_frag_data_ptr(frag_desc) + start;
		if (start >= frag_size)
		return -EINVAL;

		hp = rmnet_frag_data_ptr(frag_desc) + start;
		if (nexthdr == NEXTHDR_FRAGMENT) {
		__be16 *fp;

		if (start + offsetof(struct frag_hdr, frag_off) >=
		frag_size)
		return -EINVAL;

		fp = rmnet_frag_data_ptr(frag_desc) + start +
		offsetof(struct frag_hdr, frag_off);
		fragp = fp;