ip6_gre: fix ip6gre_err() invalid reads

Andrey Konovalov reported out of bound accesses in ip6gre_err() If GRE flags contains GRE_KEY, the following expression *(((__be32 *)p) + (grehlen / 4) - 1) accesses data ~40 bytes after the expected point, since grehlen includes the size of IPv6 headers. Let's use a "struct gre_base_hdr *greh" pointer to make this code more readable. p[1] becomes greh->protocol. grhlen is the GRE header length. Fixes: c12b395a4664 ("gre: Support GRE over IPv6") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: Andrey Konovalov <andreyknvl@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
1 files changed, 21 insertions, 19 deletions
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
Branch	Commit message	Author	Age
emaclite-cleanup	net: xilinx: emaclite: Remove net_device pointer from struct net_local	Tobias Klauser	8 years
master	Merge tag 'docs-4.10' of git://git.lwn.net/linux	Linus Torvalds	8 years
nds-private-remove	usbnet: pegasus: Use net_device_stats from struct net_device	Tobias Klauser	8 years
packet-loop-back	net: packet: Introduce PACKET_XMIT_RECEIVE socket option	Tobias Klauser	8 years
packet-rx-pump-back	net: packet: Introduce PACKET_RX_PUMP_BACK socket option	Tobias Klauser	8 years