Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f76d54a8 authored by David S. Miller's avatar David S. Miller Committed by Greg Kroah-Hartman
Browse files

ipv6: Check ip6_find_1stfragopt() return value properly. 




[ Upstream commit 7dd7eb9513bd02184d45f000ab69d78cb1fa1531 ]

Do not use unsigned variables to see if it returns a negative
error or not.

Fixes: 2423496af35d ("ipv6: Prevent overrun when parsing v6 header options")
Reported-by: default avatarJulia Lawall <julia.lawall@lip6.fr>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 017fabea

net/ipv6/ip6_offload.c

+4 −5
Original line number Diff line number Diff line
@@ -62,7 +62,6 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb, 
	const struct net_offload *ops;

	int proto;

	struct frag_hdr *fptr;

	unsigned int unfrag_ip6hlen;

	u8 *prevhdr;

	int offset = 0;

	bool encap, udpfrag;
@@ -121,10 +120,10 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb, 
		skb->network_header = (u8 *)ipv6h - skb->head;



		if (udpfrag) {

			unfrag_ip6hlen = ip6_find_1stfragopt(skb, &prevhdr);

			if (unfrag_ip6hlen < 0)

				return ERR_PTR(unfrag_ip6hlen);

			fptr = (struct frag_hdr *)((u8 *)ipv6h + unfrag_ip6hlen);

			int err = ip6_find_1stfragopt(skb, &prevhdr);

			if (err < 0)

				return ERR_PTR(err);

			fptr = (struct frag_hdr *)((u8 *)ipv6h + err);

			fptr->frag_off = htons(offset);

			if (skb->next)

				fptr->frag_off |= htons(IP6_MF);

net/ipv6/ip6_output.c

+3 −4
Original line number Diff line number Diff line
@@ -571,11 +571,10 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb, 
	int ptr, offset = 0, err = 0;

	u8 *prevhdr, nexthdr = 0;



	hlen = ip6_find_1stfragopt(skb, &prevhdr);

	if (hlen < 0) {

		err = hlen;

	err = ip6_find_1stfragopt(skb, &prevhdr);

	if (err < 0)

		goto fail;

	}

	hlen = err;

	nexthdr = *prevhdr;



	mtu = ip6_skb_dst_mtu(skb);

net/ipv6/udp_offload.c

+5 −3
Original line number Diff line number Diff line
@@ -29,6 +29,7 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb, 
	u8 frag_hdr_sz = sizeof(struct frag_hdr);

	__wsum csum;

	int tnl_hlen;

	int err;



	mss = skb_shinfo(skb)->gso_size;

	if (unlikely(skb->len <= mss))
@@ -97,9 +98,10 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb, 
		/* Find the unfragmentable header and shift it left by frag_hdr_sz

		 * bytes to insert fragment header.

		 */

		unfrag_ip6hlen = ip6_find_1stfragopt(skb, &prevhdr);

		if (unfrag_ip6hlen < 0)

			return ERR_PTR(unfrag_ip6hlen);

		err = ip6_find_1stfragopt(skb, &prevhdr);

		if (err < 0)

			return ERR_PTR(err);

		unfrag_ip6hlen = err;

		nexthdr = *prevhdr;

		*prevhdr = NEXTHDR_FRAGMENT;

		unfrag_len = (skb_network_header(skb) - skb_mac_header(skb)) +