diff options
| author | Hannes Frederic Sowa <hannes@stressinduktion.org> | 2014-05-11 23:01:13 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2014-05-14 00:40:27 -0400 |
| commit | 3a1cebe7e05027a1c96f2fc1a8eddf5f19b78f42 (patch) | |
| tree | ccff480edb57fb43e131c33549418553dba5e80e /drivers | |
| parent | 3d4405226d27b3a215e4d03cfa51f536244e5de7 (diff) | |
| download | linux-3a1cebe7e05027a1c96f2fc1a8eddf5f19b78f42.tar.gz linux-3a1cebe7e05027a1c96f2fc1a8eddf5f19b78f42.tar.bz2 linux-3a1cebe7e05027a1c96f2fc1a8eddf5f19b78f42.zip | |
ipv6: fix calculation of option len in ip6_append_data
tot_len does specify the size of struct ipv6_txoptions. We need opt_flen +
opt_nflen to calculate the overall length of additional ipv6 extensions.
I found this while auditing the ipv6 output path for a memory corruption
reported by Alexey Preobrazhensky while he fuzzed an instrumented
AddressSanitizer kernel with trinity. This may or may not be the cause
of the original bug.
Fixes: 4df98e76cde7c6 ("ipv6: pmtudisc setting not respected with UFO/CORK")
Reported-by: Alexey Preobrazhensky <preobr@google.com>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers')
0 files changed, 0 insertions, 0 deletions