summaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorJoe Stringer <joestringer@nicira.com>2015-09-14 11:14:50 -0700
committerDavid S. Miller <davem@davemloft.net>2015-09-17 15:31:49 -0700
commitcc5706056baa3002b844ff240a1cc2199a978795 (patch)
treee432102079b6cf36d60694424aeddfc5f6398df0 /net
parent37a1d3611c126fd9782ce5235791f898f053e763 (diff)
downloadlinux-stable-cc5706056baa3002b844ff240a1cc2199a978795.tar.gz
linux-stable-cc5706056baa3002b844ff240a1cc2199a978795.tar.bz2
linux-stable-cc5706056baa3002b844ff240a1cc2199a978795.zip
openvswitch: Fix IPv6 exthdr handling with ct helpers.
Static code analysis reveals the following bug: net/openvswitch/conntrack.c:281 ovs_ct_helper() warn: unsigned 'protoff' is never less than zero. This signedness bug breaks error handling for IPv6 extension headers when using conntrack helpers. Fix the error by using a local signed variable. Fixes: cae3a2627520: "openvswitch: Allow attaching helpers to ct action" Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Joe Stringer <joestringer@nicira.com> Acked-by: Pravin B Shelar <pshelar@nicira.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r--net/openvswitch/conntrack.c8
1 files changed, 5 insertions, 3 deletions
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index e8e524ad8a01..002a755fa07e 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -275,13 +275,15 @@ static int ovs_ct_helper(struct sk_buff *skb, u16 proto)
case NFPROTO_IPV6: {
u8 nexthdr = ipv6_hdr(skb)->nexthdr;
__be16 frag_off;
+ int ofs;
- protoff = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr),
- &nexthdr, &frag_off);
- if (protoff < 0 || (frag_off & htons(~0x7)) != 0) {
+ ofs = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr,
+ &frag_off);
+ if (ofs < 0 || (frag_off & htons(~0x7)) != 0) {
pr_debug("proto header not found\n");
return NF_ACCEPT;
}
+ protoff = ofs;
break;
}
default: