Patchwork ndisc: Fix padding error in link-layer address option.

login
register
mail settings
Submitter YOSHIFUJI Hideaki / 吉藤英明
Date Dec. 13, 2012, 2:29 p.m.
Message ID <201212131429.qBDETaa6029537@94.43.138.210.xn.2iij.net>
Download mbox | patch
Permalink /patch/206092/
State Accepted
Delegated to: David Miller
Headers show

Comments

YOSHIFUJI Hideaki / 吉藤英明 - Dec. 13, 2012, 2:29 p.m.
If a natural number n exists where 2 + data_len <= 8n < 2 + data_len + pad,
post padding is not initialized correctly.

(Un)fortunately, the only type that requires pad is Infiniband,
whose pad is 2 and data_len is 20, and this logical error has not
become obvious, but it is better to fix.

Note that ndisc_opt_addr_space() handles the situation described
above correctly.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
---
 net/ipv6/ndisc.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
David Miller - Dec. 13, 2012, 6:01 p.m.
From: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Date: Thu, 13 Dec 2012 23:29:36 +0900

> If a natural number n exists where 2 + data_len <= 8n < 2 + data_len + pad,
> post padding is not initialized correctly.
> 
> (Un)fortunately, the only type that requires pad is Infiniband,
> whose pad is 2 and data_len is 20, and this logical error has not
> become obvious, but it is better to fix.
> 
> Note that ndisc_opt_addr_space() handles the situation described
> above correctly.
> 
> Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>

Applied.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch

diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 92909d2..2ed42c8 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -151,8 +151,8 @@  static inline int ndisc_opt_addr_space(struct net_device *dev)
 static u8 *ndisc_fill_addr_option(u8 *opt, int type, void *data, int data_len,
 				  unsigned short addr_type)
 {
-	int space = NDISC_OPT_SPACE(data_len);
 	int pad   = ndisc_addr_option_pad(addr_type);
+	int space = NDISC_OPT_SPACE(data_len + pad);
 
 	opt[0] = type;
 	opt[1] = space>>3;