Revision 7892032cfe67f4bde6fc2ee967e45a8fbaf33756 authored by Eric Dumazet on 05 February 2017, 07:18:55 UTC, committed by David S. Miller on 05 February 2017, 22:23:04 UTC
Andrey Konovalov reported out of bound accesses in ip6gre_err()
If GRE flags contains GRE_KEY, the following expression
*(((__be32 *)p) + (grehlen / 4) - 1)
accesses data ~40 bytes after the expected point, since
grehlen includes the size of IPv6 headers.
Let's use a "struct gre_base_hdr *greh" pointer to make this
code more readable.
p[1] becomes greh->protocol.
grhlen is the GRE header length.
Fixes: c12b395a4664 ("gre: Support GRE over IPv6")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent d71b789
| File | Mode | Size |
|---|---|---|
| Kconfig | -rw-r--r-- | 68.2 KB |
| Makefile | -rw-r--r-- | 1.2 KB |
| calibrate.c | -rw-r--r-- | 8.5 KB |
| do_mounts.c | -rw-r--r-- | 14.6 KB |
| do_mounts.h | -rw-r--r-- | 1.4 KB |
| do_mounts_initrd.c | -rw-r--r-- | 3.4 KB |
| do_mounts_md.c | -rw-r--r-- | 8.2 KB |
| do_mounts_rd.c | -rw-r--r-- | 8.3 KB |
| init_task.c | -rw-r--r-- | 772 bytes |
| initramfs.c | -rw-r--r-- | 13.8 KB |
| main.c | -rw-r--r-- | 25.3 KB |
| noinitramfs.c | -rw-r--r-- | 1.5 KB |
| version.c | -rw-r--r-- | 1.2 KB |
Computing file changes ...
