/*
 * netsniff-ng - the packet sniffing beast
 * Copyright 2012 Markus Amend <markus@netsniff-ng.org>, Deutsche Flugsicherung GmbH
 * Subject to the GPL, version 2.
 *
 * IPv6 Destination Options Header described in RFC2460
 */

#include <stdio.h>
#include <stdint.h>
#include <netinet/in.h>    /* for ntohs() */

#include "proto.h"
#include "dissector_eth.h"
#include "built_in.h"
#include "pkt_buff.h"

struct dest_optshdr {
	uint8_t h_next_header;
	uint8_t hdr_len;
} __packed;


static void dissect_opt_dest(struct pkt_buff *pkt __maybe_unused,
			     ssize_t *opt_len)
{
	/* Have to been upgraded.
	 * http://tools.ietf.org/html/rfc2460#section-4.2
	 * Look also for proto_ipv6_hop_by_hop.h, it needs
	 * dissect_opt(), too.
	 */
	if (*opt_len)
		tprintf(", Option(s) recognized ");

	/* If adding dissector reduce opt_len for each using of pkt_pull
	 * to the same size.
	 */
}

static void dest_opts(struct pkt_buff *pkt)
{
	uint16_t hdr_ext_len;
	ssize_t opt_len;
	struct dest_optshdr *dest_ops;

	dest_ops = (struct dest_optshdr *) pkt_pull(pkt, sizeof(*dest_ops));
	if (dest_ops == NULL)
		return;

	/* Total Header Length in Bytes */
	hdr_ext_len = (dest_ops->hdr_len + 1) * 8;
	/* Options length in Bytes */
	opt_len = hdr_ext_len - sizeof(*dest_ops);

	tprintf("\t [ Destination Options ");
	tprintf("NextHdr (%u), ", dest_ops->h_next_header);
	if (opt_len > pkt_len(pkt) || opt_len < 0) {
	      tprintf("HdrExtLen (%u, %u Bytes, %s)", dest_ops->hdr_len,
		    hdr_ext_len, colorize_start_full(black, red)
		    "invalid" colorize_end());
		    return;
	}
	tprintf("HdrExtLen (%u, %u Bytes)", dest_ops->hdr_len,
		hdr_ext_len);

	dissect_opt_dest(pkt, &opt_len);

	tprintf(" ]\n");

	pkt_pull(pkt, opt_len);
	pkt_set_dissector(pkt, &eth_lay3, dest_ops->h_next_header);
}

static void dest_opts_less(struct pkt_buff *pkt)
{
	uint16_t hdr_ext_len;
	ssize_t opt_len;
	struct dest_optshdr *dest_ops;

	dest_ops = (struct dest_optshdr *) pkt_pull(pkt, sizeof(*dest_ops));
	if (dest_ops == NULL)
		return;

	/* Total Header Length in Bytes */
	hdr_ext_len = (dest_ops->hdr_len + 1) * 8;
	/* Options length in Bytes */
	opt_len = hdr_ext_len - sizeof(*dest_ops);
	if (opt_len > pkt_len(pkt) || opt_len < 0)
		return;

	tprintf(" Dest Ops");

	pkt_pull(pkt, opt_len);
	pkt_set_dissector(pkt, &eth_lay3, dest_ops->h_next_header);
}

struct protocol ipv6_dest_opts_ops = {
	.key = 0x3C,
	.print_full = dest_opts,
	.print_less = dest_opts_less,
};
linux/net-next.git/commit/sound/arm/Makefile'>Makefile</a></div><div class='content'><div class='cgit-panel'><b>diff options</b><form method='get'><table><tr><td colspan='2'/></tr><tr><td class='label'>context:</td><td class='ctrl'><select name='context' onchange='this.form.submit();'><option value='1'>1</option><option value='2'>2</option><option value='3' selected='selected'>3</option><option value='4'>4</option><option value='5'>5</option><option value='6'>6</option><option value='7'>7</option><option value='8'>8</option><option value='9'>9</option><option value='10'>10</option><option value='15'>15</option><option value='20'>20</option><option value='25'>25</option><option value='30'>30</option><option value='35'>35</option><option value='40'>40</option></select></td></tr><tr><td class='label'>space:</td><td class='ctrl'><select name='ignorews' onchange='this.form.submit();'><option value='0' selected='selected'>include</option><option value='1'>ignore</option></select></td></tr><tr><td class='label'>mode:</td><td class='ctrl'><select name='dt' onchange='this.form.submit();'><option value='0' selected='selected'>unified</option><option value='1'>ssdiff</option><option value='2'>stat only</option></select></td></tr><tr><td/><td class='ctrl'><noscript><input type='submit' value='reload'/></noscript></td></tr></table></form></div><table summary='commit info' class='commit-info'>
<tr><th>author</th><td>Linus Torvalds &lt;torvalds@linux-foundation.org&gt;</td><td class='right'>2016-12-12 21:58:13 -0800</td></tr>
<tr><th>committer</th><td>Linus Torvalds &lt;torvalds@linux-foundation.org&gt;</td><td class='right'>2016-12-12 21:58:13 -0800</td></tr>
<tr><th>commit</th><td colspan='2' class='oid'><a href='/cgit.cgi/linux/net-next.git/commit/sound/arm/Makefile?id=e7aa8c2eb11ba69b1b69099c3c7bd6be3087b0ba'>e7aa8c2eb11ba69b1b69099c3c7bd6be3087b0ba</a> (<a href='/cgit.cgi/linux/net-next.git/patch/sound/arm/Makefile?id=e7aa8c2eb11ba69b1b69099c3c7bd6be3087b0ba'>patch</a>)</td></tr>
<tr><th>tree</th><td colspan='2' class='oid'><a href='/cgit.cgi/linux/net-next.git/tree/'>f63906f41699c8e38af9d12b063e2ceab0286ef2</a> /<a href='/cgit.cgi/linux/net-next.git/tree/sound/arm/Makefile'>sound/arm/Makefile</a></td></tr>
<tr><th>parent</th><td colspan='2' class='oid'><a href='/cgit.cgi/linux/net-next.git/commit/sound/arm/Makefile?id=e34bac726d27056081d0250c0e173e4b155aa340'>e34bac726d27056081d0250c0e173e4b155aa340</a> (<a href='/cgit.cgi/linux/net-next.git/diff/sound/arm/Makefile?id2=e34bac726d27056081d0250c0e173e4b155aa340'>diff</a>)</td></tr><tr><th>parent</th><td colspan='2' class='oid'><a href='/cgit.cgi/linux/net-next.git/commit/sound/arm/Makefile?id=868c97a846a73e937d835b09b8c885a69df50ec8'>868c97a846a73e937d835b09b8c885a69df50ec8</a> (<a href='/cgit.cgi/linux/net-next.git/diff/sound/arm/Makefile?id2=868c97a846a73e937d835b09b8c885a69df50ec8'>diff</a>)</td></tr></table>
<div class='commit-subject'>Merge tag 'docs-4.10' of git://git.lwn.net/linux<span class='decoration'><a class='deco' href='/cgit.cgi/linux/net-next.git/commit/sound/arm/Makefile?id=e7aa8c2eb11ba69b1b69099c3c7bd6be3087b0ba'>HEAD</a><a class='branch-deco' href='/cgit.cgi/linux/net-next.git/log/sound/arm/Makefile'>master</a></span></div><div class='commit-msg'>Pull documentation update from Jonathan Corbet:
 "These are the documentation changes for 4.10.

  It's another busy cycle for the docs tree, as the sphinx conversion
  continues. Highlights include:

   - Further work on PDF output, which remains a bit of a pain but
     should be more solid now.

   - Five more DocBook template files converted to Sphinx. Only 27 to
     go... Lots of plain-text files have also been converted and
     integrated.

   - Images in binary formats have been replaced with more
     source-friendly versions.

   - Various bits of organizational work, including the renaming of
     various files discussed at the kernel summit.

   - New documentation for the device_link mechanism.

  ... and, of course, lots of typo fixes and small updates"

* tag 'docs-4.10' of git://git.lwn.net/linux: (193 commits)
  dma-buf: Extract dma-buf.rst
  Update Documentation/00-INDEX
  docs: 00-INDEX: document directories/files with no docs
  docs: 00-INDEX: remove non-existing entries
  docs: 00-INDEX: add missing entries for documentation files/dirs
  docs: 00-INDEX: consolidate process/ and admin-guide/ description
  scripts: add a script to check if Documentation/00-INDEX is sane
  Docs: change sh -&gt; awk in REPORTING-BUGS
  Documentation/core-api/device_link: Add initial documentation
  core-api: remove an unexpected unident
  ppc/idle: Add documentation for powersave=off
  Doc: Correct typo, "Introdution" =&gt; "Introduction"
  Documentation/atomic_ops.txt: convert to ReST markup
  Documentation/local_ops.txt: convert to ReST markup
  Documentation/assoc_array.txt: convert to ReST markup
  docs-rst: parse-headers.pl: cleanup the documentation
  docs-rst: fix media cleandocs target
  docs-rst: media/Makefile: reorganize the rules
  docs-rst: media: build SVG from graphviz files
  docs-rst: replace bayer.png by a SVG image
  ...
</div><div class='diffstat-header'><a href='/cgit.cgi/linux/net-next.git/diff/'>Diffstat</a> (limited to 'sound/arm/Makefile')</div><table summary='diffstat' class='diffstat'>angeset is stale and
needs to respin. Userspace can do this transparently at the cost of
taking slightly more time to refresh caches and rework the changeset.

This check is optional, if there is no NFNL_BATCH_GENID attribute in the
batch begin message, then no check is performed.

Signed-off-by: Pablo Neira Ayuso &lt;pablo@netfilter.org&gt;


</td></tr>
<tr class='logheader'><td><span title='2017-02-12 14:45:10 +0100'>2017-02-12</span></td><td class='logsubject'><a href='/cgit.cgi/linux/net-next.git/commit/net?id=48656835c0405aa2e6c0d6a4305c77b70758d168'>netfilter: nfnetlink: add nfnetlink_rcv_skb_batch()</a></td><td>Pablo Neira Ayuso</td><td>1</td><td><span class='deletions'>-23</span>/<span class='insertions'>+28</span></td></tr>
<tr class='nohover-highlight'><td/><td colspan='5' class='logmsg'>
Add new nfnetlink_rcv_skb_batch() to wrap initial nfnetlink batch
handling.

Signed-off-by: Pablo Neira Ayuso &lt;pablo@netfilter.org&gt;


</td></tr>
<tr class='logheader'><td><span title='2017-02-12 14:45:09 +0100'>2017-02-12</span></td><td class='logsubject'><a href='/cgit.cgi/linux/net-next.git/commit/net?id=b745d0358db44ebcef31478314436d6d4ff93bfa'>netfilter: nfnetlink: get rid of u_intX_t types</a></td><td>Pablo Neira Ayuso</td><td>1</td><td><span class='deletions'>-8</span>/<span class='insertions'>+8</span></td></tr>
<tr class='nohover-highlight'><td/><td colspan='5' class='logmsg'>
Use uX types instead.

Signed-off-by: Pablo Neira Ayuso &lt;pablo@netfilter.org&gt;


</td></tr>
<tr class='logheader'><td><span title='2017-02-12 14:44:08 +0100'>2017-02-12</span></td><td class='logsubject'><a href='/cgit.cgi/linux/net-next.git/commit/net?id=4dee62b1b9b43c9bbf49c93cd114e1bf1334fb6a'>netfilter: nf_ct_expect: nf_ct_expect_insert() returns void</a></td><td>Gao Feng</td><td>1</td><td><span class='deletions'>-5</span>/<span class='insertions'>+3</span></td></tr>
<tr class='nohover-highlight'><td/><td colspan='5' class='logmsg'>
Because nf_ct_expect_insert() always succeeds now, its return value can
be just void instead of int. And remove code that checks for its return
value.

Signed-off-by: Gao Feng &lt;fgao@ikuai8.com&gt;
Signed-off-by: Pablo Neira Ayuso &lt;pablo@netfilter.org&gt;


</td></tr>
<tr class='logheader'><td><span title='2017-02-12 14:39:06 +0100'>2017-02-12</span></td><td class='logsubject'><a href='/cgit.cgi/linux/net-next.git/commit/net?id=a96e66e702bc615f5927b15c739c91d5098dac59'>netfilter: nf_ct_sip: Use mod_timer_pending()</a></td><td>Gao Feng</td><td>1</td><td><span class='deletions'>-7</span>/<span class='insertions'>+5</span></td></tr>
<tr class='nohover-highlight'><td/><td colspan='5' class='logmsg'>
timer_del() followed by timer_add() can be replaced by
mod_timer_pending().

Signed-off-by: Gao Feng &lt;fgao@ikuai8.com&gt;
Signed-off-by: Pablo Neira Ayuso &lt;pablo@netfilter.org&gt;


</td></tr>
<tr class='logheader'><td><span title='2017-02-11 21:38:58 -0500'>2017-02-11</span></td><td class='logsubject'><a href='/cgit.cgi/linux/net-next.git/commit/net?id=87b60cfacf9f17cf71933c6e33b66e68160af71d'>net_sched: fix error recovery at qdisc creation</a></td><td>Eric Dumazet</td><td>5</td><td><span class='deletions'>-23</span>/<span class='insertions'>+19</span></td></tr>
<tr class='nohover-highlight'><td/><td colspan='5' class='logmsg'>
Dmitry reported uses after free in qdisc code [1]

The problem here is that ops-&gt;init() can return an error.

qdisc_create_dflt() then call ops-&gt;destroy(),
while qdisc_create() does _not_ call it.

Four qdisc chose to call their own ops-&gt;destroy(), assuming their caller
would not.

This patch makes sure qdisc_create() calls ops-&gt;destroy()
and fixes the four qdisc to avoid double free.

[1]
BUG: KASAN: use-after-free in mq_destroy+0x242/0x290 net/sched/sch_mq.c:33 at addr ffff8801d415d440
Read of size 8 by task syz-executor2/5030
CPU: 0 PID: 5030 Comm: syz-executor2 Not tainted 4.3.5-smp-DEV #119
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 0000000000000046 ffff8801b435b870 ffffffff81bbbed4 ffff8801db000400
 ffff8801d415d440 ffff8801d415dc40 ffff8801c4988510 ffff8801b435b898
 ffffffff816682b1 ffff8801b435b928 ffff8801d415d440 ffff8801c49880c0
Call Trace:
 [&lt;ffffffff81bbbed4&gt;] __dump_stack lib/dump_stack.c:15 [inline]
 [&lt;ffffffff81bbbed4&gt;] dump_stack+0x6c/0x98 lib/dump_stack.c:51
 [&lt;ffffffff816682b1&gt;] kasan_object_err+0x21/0x70 mm/kasan/report.c:158
 [&lt;ffffffff81668524&gt;] print_address_description mm/kasan/report.c:196 [inline]
 [&lt;ffffffff81668524&gt;] kasan_report_error+0x1b4/0x4b0 mm/kasan/report.c:285
 [&lt;ffffffff81668953&gt;] kasan_report mm/kasan/report.c:305 [inline]
 [&lt;ffffffff81668953&gt;] __asan_report_load8_noabort+0x43/0x50 mm/kasan/report.c:326
 [&lt;ffffffff82527b02&gt;] mq_destroy+0x242/0x290 net/sched/sch_mq.c:33
 [&lt;ffffffff82524bdd&gt;] qdisc_destroy+0x12d/0x290 net/sched/sch_generic.c:953
 [&lt;ffffffff82524e30&gt;] qdisc_create_dflt+0xf0/0x120 net/sched/sch_generic.c:848
 [&lt;ffffffff8252550d&gt;] attach_default_qdiscs net/sched/sch_generic.c:1029 [inline]
 [&lt;ffffffff8252550d&gt;] dev_activate+0x6ad/0x880 net/sched/sch_generic.c:1064
 [&lt;ffffffff824b1db1&gt;] __dev_open+0x221/0x320 net/core/dev.c:1403
 [&lt;ffffffff824b24ce&gt;] __dev_change_flags+0x15e/0x3e0 net/core/dev.c:6858
 [&lt;ffffffff824b27de&gt;] dev_change_flags+0x8e/0x140 net/core/dev.c:6926
 [&lt;ffffffff824f5bf6&gt;] dev_ifsioc+0x446/0x890 net/core/dev_ioctl.c:260
 [&lt;ffffffff824f61fa&gt;] dev_ioctl+0x1ba/0xb80 net/core/dev_ioctl.c:546
 [&lt;ffffffff82430509&gt;] sock_do_ioctl+0x99/0xb0 net/socket.c:879
 [&lt;ffffffff82430d30&gt;] sock_ioctl+0x2a0/0x390 net/socket.c:958
 [&lt;ffffffff816f3b68&gt;] vfs_ioctl fs/ioctl.c:44 [inline]
 [&lt;ffffffff816f3b68&gt;] do_vfs_ioctl+0x8a8/0xe50 fs/ioctl.c:611
 [&lt;ffffffff816f41a4&gt;] SYSC_ioctl fs/ioctl.c:626 [inline]
 [&lt;ffffffff816f41a4&gt;] SyS_ioctl+0x94/0xc0 fs/ioctl.c:617
 [&lt;ffffffff8123e357&gt;] entry_SYSCALL_64_fastpath+0x12/0x17

Signed-off-by: Eric Dumazet &lt;edumazet@google.com&gt;
Reported-by: Dmitry Vyukov &lt;dvyukov@google.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;


</td></tr>
<tr class='logheader'><td><span title='2017-02-11 21:25:18 -0500'>2017-02-11</span></td><td class='logsubject'><a href='/cgit.cgi/linux/net-next.git/commit/net?id=c16ec18599c8c1722d476011786fd9e2529888f7'>net: rename dst_neigh_output back to neigh_output</a></td><td>Julian Anastasov</td><td>2</td><td><span class='deletions'>-2</span>/<span class='insertions'>+2</span></td></tr>
<tr class='nohover-highlight'><td/><td colspan='5' class='logmsg'>
After the dst-&gt;pending_confirm flag was removed, we do not
need anymore to provide dst arg to dst_neigh_output.
So, rename it to neigh_output as before commit 5110effee8fd
("net: Do delayed neigh confirmation.").

Signed-off-by: Julian Anastasov &lt;ja@ssi.bg&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;


</td></tr>
<tr class='logheader'><td><span title='2017-02-11 02:31:11 -0500'>2017-02-11</span></td><td class='logsubject'><a href='/cgit.cgi/linux/net-next.git/commit/net?id=35eeacf1820a08305c2b0960febfa190f5a6dd63'>Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net</a></td><td>David S. Miller