On Tue, Oct 12, 2021 at 6:30 PM Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote: > > On Tue, Oct 12, 2021 at 12:02:04PM +0200, Florian Westphal wrote: > > Xin Long <lucien.xin@xxxxxxxxx> wrote: > > > In rt_mt6(), when it's a nonlinear skb, the 1st skb_header_pointer() > > > only copies sizeof(struct ipv6_rt_hdr) to _route that rh points to. > > > The access by ((const struct rt0_hdr *)rh)->reserved will overflow > > > the buffer. So this access should be moved below the 2nd call to > > > skb_header_pointer(). > > > > > > Besides, after the 2nd skb_header_pointer(), its return value should > > > also be checked, othersize, *rp may cause null-pointer-ref. > > > > Patch looks good but I think you can just axe these pr_debug statements > > instead of moving them. > > > > Before pr_debug conversion these statments were #if-0 out, I don't think > > they'll be missed if they are removed. > > Agreed. Posted v2. Thanks.
