diff options
| author | Ben Hutchings <ben@decadent.org.uk> | 2017-05-31 15:15:41 +0300 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2017-06-02 20:57:27 +0300 |
| commit | 6e80ac5cc992ab6256c3dae87f7e57db15e1a58c (patch) | |
| tree | ab042c99dd3349f1cf7d8af7dd585db670d6ff58 /net/ipv6/xfrm6_mode_transport.c | |
| parent | 13fb6c2c7fe10ce39a5549c268e35341d83f2b3d (diff) | |
| download | linux-6e80ac5cc992ab6256c3dae87f7e57db15e1a58c.tar.xz | |
ipv6: xfrm: Handle errors reported by xfrm6_find_1stfragopt()
xfrm6_find_1stfragopt() may now return an error code and we must
not treat it as a length.
Fixes: 2423496af35d ("ipv6: Prevent overrun when parsing v6 header options")
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Acked-by: Craig Gallek <kraig@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv6/xfrm6_mode_transport.c')
| -rw-r--r-- | net/ipv6/xfrm6_mode_transport.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/net/ipv6/xfrm6_mode_transport.c b/net/ipv6/xfrm6_mode_transport.c index 7a92c0f31912..9ad07a91708e 100644 --- a/net/ipv6/xfrm6_mode_transport.c +++ b/net/ipv6/xfrm6_mode_transport.c @@ -30,6 +30,8 @@ static int xfrm6_transport_output(struct xfrm_state *x, struct sk_buff *skb) skb_set_inner_transport_header(skb, skb_transport_offset(skb)); hdr_len = x->type->hdr_offset(x, skb, &prevhdr); + if (hdr_len < 0) + return hdr_len; skb_set_mac_header(skb, (prevhdr - x->props.header_len) - skb->data); skb_set_network_header(skb, -x->props.header_len); skb->transport_header = skb->network_header + hdr_len; |