diff options
| author | Joe Stringer <joestringer@nicira.com> | 2015-09-14 20:14:50 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2015-09-18 00:31:49 +0200 |
| commit | cc5706056baa3002b844ff240a1cc2199a978795 (patch) | |
| tree | e432102079b6cf36d60694424aeddfc5f6398df0 /net | |
| parent | ipv6: include NLM_F_REPLACE in route replace notifications (diff) | |
| download | linux-cc5706056baa3002b844ff240a1cc2199a978795.tar.xz linux-cc5706056baa3002b844ff240a1cc2199a978795.zip | |
openvswitch: Fix IPv6 exthdr handling with ct helpers.
Static code analysis reveals the following bug:
net/openvswitch/conntrack.c:281 ovs_ct_helper()
warn: unsigned 'protoff' is never less than zero.
This signedness bug breaks error handling for IPv6 extension headers when
using conntrack helpers. Fix the error by using a local signed variable.
Fixes: cae3a2627520: "openvswitch: Allow attaching helpers to ct
action"
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Joe Stringer <joestringer@nicira.com>
Acked-by: Pravin B Shelar <pshelar@nicira.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
| -rw-r--r-- | net/openvswitch/conntrack.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c index e8e524ad8a01..002a755fa07e 100644 --- a/net/openvswitch/conntrack.c +++ b/net/openvswitch/conntrack.c @@ -275,13 +275,15 @@ static int ovs_ct_helper(struct sk_buff *skb, u16 proto) case NFPROTO_IPV6: { u8 nexthdr = ipv6_hdr(skb)->nexthdr; __be16 frag_off; + int ofs; - protoff = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), - &nexthdr, &frag_off); - if (protoff < 0 || (frag_off & htons(~0x7)) != 0) { + ofs = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr, + &frag_off); + if (ofs < 0 || (frag_off & htons(~0x7)) != 0) { pr_debug("proto header not found\n"); return NF_ACCEPT; } + protoff = ofs; break; } default: |