diff options
| author | Eric Dumazet <edumazet@google.com> | 2017-02-04 23:18:55 -0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2017-02-18 16:39:26 +0100 |
| commit | eaa3a58f450383aaa8632eea23f2a70d85c55d9d (patch) | |
| tree | 9e6ddd6be38055754ac258fc09f33cdfe45fafe3 /arch/nios2 | |
| parent | 13c3646dac70dbad417cce1ddfd87bd6f8650224 (diff) | |
ip6_gre: fix ip6gre_err() invalid reads
[ Upstream commit 7892032cfe67f4bde6fc2ee967e45a8fbaf33756 ]
Andrey Konovalov reported out of bound accesses in ip6gre_err()
If GRE flags contains GRE_KEY, the following expression
*(((__be32 *)p) + (grehlen / 4) - 1)
accesses data ~40 bytes after the expected point, since
grehlen includes the size of IPv6 headers.
Let's use a "struct gre_base_hdr *greh" pointer to make this
code more readable.
p[1] becomes greh->protocol.
grhlen is the GRE header length.
Fixes: c12b395a4664 ("gre: Support GRE over IPv6")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'arch/nios2')
0 files changed, 0 insertions, 0 deletions