Eric Lee / smarc-fsl-linux-kernel

Download as
Browse Code ยป

Commit 540436c80e5918dd5ed838449e108b1726fc4d68

Authored by Daniel Borkmann
Committed by Pablo Neira Ayuso
1 parent 45c2aff645

netfilter: nft_exthdr: call ipv6_find_hdr() with explicitly initialized offset 

In nft's nft_exthdr_eval() routine we process IPv6 extension header
through invoking ipv6_find_hdr(), but we call it with an uninitialized
offset variable that contains some stack value. In ipv6_find_hdr()
we then test if the value of offset != 0 and call skb_header_pointer()
on that offset in order to map struct ipv6hdr into it. Fix it up by
initializing offset to 0 as it was probably intended to be.

Fixes: 96518518cc41 ("netfilter: add nftables")
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

Showing 1 changed file with 1 additions and 1 deletions Side-by-side Diff

net/netfilter/nft_exthdr.c
Diff comments   View file @ 540436c
... ... @@ -31,7 +31,7 @@
31 31 {
32 32 struct nft_exthdr *priv = nft_expr_priv(expr);
33 33 struct nft_data *dest = &data[priv->dreg];
34   - unsigned int offset;
  34 + unsigned int offset = 0;
35 35 int err;
36 36  
37 37 err = ipv6_find_hdr(pkt->skb, &offset, priv->type, NULL, NULL);