Unverified Commit 9082d71c authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!5531 ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() 

Merge Pull Request from: @ci-robot 
 
PR sync from: Dong Chenchen <dongchenchen2@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/SJPGGWMK4ALZINWX4H73Z2SOBPMZR5GZ/ 
 
https://gitee.com/src-openeuler/kernel/issues/I99K08 
 
Link:https://gitee.com/openeuler/kernel/pulls/5531

 

Reviewed-by: default avatarLiu YongQiang <liuyongqiang13@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents dba34786 b81ce7b0

net/ipv6/ip6_tunnel.c

+13 −13
Original line number Diff line number Diff line
@@ -404,7 +404,7 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw) 
	const struct ipv6hdr *ipv6h = (const struct ipv6hdr *)raw;

	unsigned int nhoff = raw - skb->data;

	unsigned int off = nhoff + sizeof(*ipv6h);

	u8 next, nexthdr = ipv6h->nexthdr;

	u8 nexthdr = ipv6h->nexthdr;



	while (ipv6_ext_hdr(nexthdr) && nexthdr != NEXTHDR_NONE) {

		struct ipv6_opt_hdr *hdr;
@@ -415,26 +415,26 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw) 


		hdr = (struct ipv6_opt_hdr *)(skb->data + off);

		if (nexthdr == NEXTHDR_FRAGMENT) {

			struct frag_hdr *frag_hdr = (struct frag_hdr *) hdr;

			if (frag_hdr->frag_off)

				break;

			optlen = 8;

		} else if (nexthdr == NEXTHDR_AUTH) {

			optlen = (hdr->hdrlen + 2) << 2;

		} else {

			optlen = ipv6_optlen(hdr);

		}

		/* cache hdr->nexthdr, since pskb_may_pull() might

		 * invalidate hdr

		 */

		next = hdr->nexthdr;

		if (nexthdr == NEXTHDR_DEST) {

			u16 i = 2;



			/* Remember : hdr is no longer valid at this point. */

		if (!pskb_may_pull(skb, off + optlen))

			break;



		hdr = (struct ipv6_opt_hdr *)(skb->data + off);

		if (nexthdr == NEXTHDR_FRAGMENT) {

			struct frag_hdr *frag_hdr = (struct frag_hdr *)hdr;



			if (frag_hdr->frag_off)

				break;

		}

		if (nexthdr == NEXTHDR_DEST) {

			u16 i = 2;



			while (1) {

				struct ipv6_tlv_tnl_enc_lim *tel;
@@ -454,7 +454,7 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw) 
					i++;

			}

		}

		nexthdr = next;

		nexthdr = hdr->nexthdr;

		off += optlen;

	}

	return 0;