Xin Long <lucien.xin@xxxxxxxxx> wrote: > In rt_mt6(), when it's a nonlinear skb, the 1st skb_header_pointer() > only copies sizeof(struct ipv6_rt_hdr) to _route that rh points to. > The access by ((const struct rt0_hdr *)rh)->reserved will overflow > the buffer. So this access should be moved below the 2nd call to > skb_header_pointer(). > > Besides, after the 2nd skb_header_pointer(), its return value should > also be checked, othersize, *rp may cause null-pointer-ref. > > v1->v2: > - clean up some old debugging log. Acked-by: Florian Westphal <fw@xxxxxxxxx>
