Merge "net: qualcomm: rmnet: validate ipv6 extension header lengths" (7729adaf) · Commits · e / devices / android_kernel_xiaomi_nabu

drivers/net/ethernet/qualcomm/rmnet/rmnet_descriptor.c

+8 −1

Original line number	Diff line number	Diff line
		@@ -103,6 +103,7 @@ EXPORT_SYMBOL(rmnet_descriptor_add_frag);
		int rmnet_frag_ipv6_skip_exthdr(struct rmnet_frag_descriptor *frag_desc,
		int start, u8 nexthdrp, __be16 fragp)
		{
		u32 frag_size = skb_frag_size(&frag_desc->frag);
		u8 nexthdr = *nexthdrp;

		*fragp = 0;
		@@ -114,11 +115,17 @@ int rmnet_frag_ipv6_skip_exthdr(struct rmnet_frag_descriptor *frag_desc,
		if (nexthdr == NEXTHDR_NONE)
		return -EINVAL;

		hp = rmnet_frag_data_ptr(frag_desc) + start;
		if (start >= frag_size)
		return -EINVAL;

		hp = rmnet_frag_data_ptr(frag_desc) + start;
		if (nexthdr == NEXTHDR_FRAGMENT) {
		__be16 *fp;

		if (start + offsetof(struct frag_hdr, frag_off) >=
		frag_size)
		return -EINVAL;

		fp = rmnet_frag_data_ptr(frag_desc) + start +
		offsetof(struct frag_hdr, frag_off);
		fragp = fp;