| From foo@baz Wed May 31 09:13:34 JST 2017 |
| From: "David S. Miller" <davem@davemloft.net> |
| Date: Wed, 17 May 2017 22:54:11 -0400 |
| Subject: ipv6: Check ip6_find_1stfragopt() return value properly. |
| |
| From: "David S. Miller" <davem@davemloft.net> |
| |
| |
| [ Upstream commit 7dd7eb9513bd02184d45f000ab69d78cb1fa1531 ] |
| |
| Do not use unsigned variables to see if it returns a negative |
| error or not. |
| |
| Fixes: 2423496af35d ("ipv6: Prevent overrun when parsing v6 header options") |
| Reported-by: Julia Lawall <julia.lawall@lip6.fr> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| net/ipv6/ip6_offload.c | 9 ++++----- |
| net/ipv6/ip6_output.c | 7 +++---- |
| net/ipv6/udp_offload.c | 8 +++++--- |
| 3 files changed, 12 insertions(+), 12 deletions(-) |
| |
| --- a/net/ipv6/ip6_offload.c |
| +++ b/net/ipv6/ip6_offload.c |
| @@ -63,7 +63,6 @@ static struct sk_buff *ipv6_gso_segment( |
| const struct net_offload *ops; |
| int proto; |
| struct frag_hdr *fptr; |
| - unsigned int unfrag_ip6hlen; |
| unsigned int payload_len; |
| u8 *prevhdr; |
| int offset = 0; |
| @@ -116,10 +115,10 @@ static struct sk_buff *ipv6_gso_segment( |
| skb->network_header = (u8 *)ipv6h - skb->head; |
| |
| if (udpfrag) { |
| - unfrag_ip6hlen = ip6_find_1stfragopt(skb, &prevhdr); |
| - if (unfrag_ip6hlen < 0) |
| - return ERR_PTR(unfrag_ip6hlen); |
| - fptr = (struct frag_hdr *)((u8 *)ipv6h + unfrag_ip6hlen); |
| + int err = ip6_find_1stfragopt(skb, &prevhdr); |
| + if (err < 0) |
| + return ERR_PTR(err); |
| + fptr = (struct frag_hdr *)((u8 *)ipv6h + err); |
| fptr->frag_off = htons(offset); |
| if (skb->next) |
| fptr->frag_off |= htons(IP6_MF); |
| --- a/net/ipv6/ip6_output.c |
| +++ b/net/ipv6/ip6_output.c |
| @@ -586,11 +586,10 @@ int ip6_fragment(struct net *net, struct |
| int ptr, offset = 0, err = 0; |
| u8 *prevhdr, nexthdr = 0; |
| |
| - hlen = ip6_find_1stfragopt(skb, &prevhdr); |
| - if (hlen < 0) { |
| - err = hlen; |
| + err = ip6_find_1stfragopt(skb, &prevhdr); |
| + if (err < 0) |
| goto fail; |
| - } |
| + hlen = err; |
| nexthdr = *prevhdr; |
| |
| mtu = ip6_skb_dst_mtu(skb); |
| --- a/net/ipv6/udp_offload.c |
| +++ b/net/ipv6/udp_offload.c |
| @@ -29,6 +29,7 @@ static struct sk_buff *udp6_ufo_fragment |
| u8 frag_hdr_sz = sizeof(struct frag_hdr); |
| __wsum csum; |
| int tnl_hlen; |
| + int err; |
| |
| mss = skb_shinfo(skb)->gso_size; |
| if (unlikely(skb->len <= mss)) |
| @@ -90,9 +91,10 @@ static struct sk_buff *udp6_ufo_fragment |
| /* Find the unfragmentable header and shift it left by frag_hdr_sz |
| * bytes to insert fragment header. |
| */ |
| - unfrag_ip6hlen = ip6_find_1stfragopt(skb, &prevhdr); |
| - if (unfrag_ip6hlen < 0) |
| - return ERR_PTR(unfrag_ip6hlen); |
| + err = ip6_find_1stfragopt(skb, &prevhdr); |
| + if (err < 0) |
| + return ERR_PTR(err); |
| + unfrag_ip6hlen = err; |
| nexthdr = *prevhdr; |
| *prevhdr = NEXTHDR_FRAGMENT; |
| unfrag_len = (skb_network_header(skb) - skb_mac_header(skb)) + |