| Message ID | 5ec9759a19d4eba5f7f9006354da2cfeb39fa839.1591612830.git.geliangtang@gmail.com |
|---|---|
| State | Accepted |
| Delegated to: | David Miller |
| Headers | show |
| Series | [net,v2] mptcp: bugfix for RM_ADDR option parsing | expand |
Hi Geliang, On 08/06/2020 12:47, Geliang Tang wrote: > In MPTCPOPT_RM_ADDR option parsing, the pointer "ptr" pointed to the > "Subtype" octet, the pointer "ptr+1" pointed to the "Address ID" octet: > > +-------+-------+---------------+ > |Subtype|(resvd)| Address ID | > +-------+-------+---------------+ > | | > ptr ptr+1 > > We should set mp_opt->rm_id to the value of "ptr+1", not "ptr". This patch > will fix this bug. > > Fixes: 3df523ab582c ("mptcp: Add ADD_ADDR handling") > Signed-off-by: Geliang Tang <geliangtang@gmail.com> > --- > Changes in v2: > - Add "-net" subject and "Fixes" tag as Matt suggested. Thanks for this v2! LGTM! Reviewed-by: Matthieu Baerts <matthieu.baerts@tessares.net> Cheers, Matt
From: Geliang Tang <geliangtang@gmail.com> Date: Mon, 8 Jun 2020 18:47:54 +0800 > In MPTCPOPT_RM_ADDR option parsing, the pointer "ptr" pointed to the > "Subtype" octet, the pointer "ptr+1" pointed to the "Address ID" octet: > > +-------+-------+---------------+ > |Subtype|(resvd)| Address ID | > +-------+-------+---------------+ > | | > ptr ptr+1 > > We should set mp_opt->rm_id to the value of "ptr+1", not "ptr". This patch > will fix this bug. > > Fixes: 3df523ab582c ("mptcp: Add ADD_ADDR handling") > Signed-off-by: Geliang Tang <geliangtang@gmail.com> > --- > Changes in v2: > - Add "-net" subject and "Fixes" tag as Matt suggested. Applied and queued up for v5.7 -stable, thanks!
diff --git a/net/mptcp/options.c b/net/mptcp/options.c index 01f1f4cf4902..490b92534afc 100644 --- a/net/mptcp/options.c +++ b/net/mptcp/options.c @@ -273,6 +273,8 @@ static void mptcp_parse_option(const struct sk_buff *skb, if (opsize != TCPOLEN_MPTCP_RM_ADDR_BASE) break; + ptr++; + mp_opt->rm_addr = 1; mp_opt->rm_id = *ptr++; pr_debug("RM_ADDR: id=%d", mp_opt->rm_id);
In MPTCPOPT_RM_ADDR option parsing, the pointer "ptr" pointed to the "Subtype" octet, the pointer "ptr+1" pointed to the "Address ID" octet: +-------+-------+---------------+ |Subtype|(resvd)| Address ID | +-------+-------+---------------+ | | ptr ptr+1 We should set mp_opt->rm_id to the value of "ptr+1", not "ptr". This patch will fix this bug. Fixes: 3df523ab582c ("mptcp: Add ADD_ADDR handling") Signed-off-by: Geliang Tang <geliangtang@gmail.com> --- Changes in v2: - Add "-net" subject and "Fixes" tag as Matt suggested. --- net/mptcp/options.c | 2 ++ 1 file changed, 2 insertions(+)