diff options
| author | Hannes Frederic Sowa <hannes@stressinduktion.org> | 2014-05-11 23:01:13 +0200 |
|---|---|---|
| committer | Show Liu <show.liu@linaro.org> | 2014-06-18 12:04:02 +0800 |
| commit | a721895c5d1cd698e73badd783025cf2abcb7929 (patch) | |
| tree | 60fc79447d1e9f523d1573c673c61353d4fb8166 /net | |
| parent | a8ba5c437981b560b559b38252f3fb7df50439fb (diff) | |
ipv6: fix calculation of option len in ip6_append_data
[ Upstream commit 3a1cebe7e05027a1c96f2fc1a8eddf5f19b78f42 ]
tot_len does specify the size of struct ipv6_txoptions. We need opt_flen +
opt_nflen to calculate the overall length of additional ipv6 extensions.
I found this while auditing the ipv6 output path for a memory corruption
reported by Alexey Preobrazhensky while he fuzzed an instrumented
AddressSanitizer kernel with trinity. This may or may not be the cause
of the original bug.
Fixes: 4df98e76cde7c6 ("ipv6: pmtudisc setting not respected with UFO/CORK")
Reported-by: Alexey Preobrazhensky <preobr@google.com>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/ipv6/ip6_output.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c index 264a984ae16..a62b610307e 100644 --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c @@ -1229,7 +1229,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to, unsigned int maxnonfragsize, headersize; headersize = sizeof(struct ipv6hdr) + - (opt ? opt->tot_len : 0) + + (opt ? opt->opt_flen + opt->opt_nflen : 0) + (dst_allfrag(&rt->dst) ? sizeof(struct frag_hdr) : 0) + rt->rt6i_nfheader_len; |