Commit 540436c8 authored by Daniel Borkmann's avatar Daniel Borkmann Committed by Pablo Neira Ayuso

netfilter: nft_exthdr: call ipv6_find_hdr() with explicitly initialized offset

In nft's nft_exthdr_eval() routine we process IPv6 extension header
through invoking ipv6_find_hdr(), but we call it with an uninitialized
offset variable that contains some stack value. In ipv6_find_hdr()
we then test if the value of offset != 0 and call skb_header_pointer()
on that offset in order to map struct ipv6hdr into it. Fix it up by
initializing offset to 0 as it was probably intended to be.

Fixes: 96518518 ("netfilter: add nftables")
Signed-off-by: default avatarDaniel Borkmann <dborkman@redhat.com>
Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 45c2aff6
...@@ -31,7 +31,7 @@ static void nft_exthdr_eval(const struct nft_expr *expr, ...@@ -31,7 +31,7 @@ static void nft_exthdr_eval(const struct nft_expr *expr,
{ {
struct nft_exthdr *priv = nft_expr_priv(expr); struct nft_exthdr *priv = nft_expr_priv(expr);
struct nft_data *dest = &data[priv->dreg]; struct nft_data *dest = &data[priv->dreg];
unsigned int offset; unsigned int offset = 0;
int err; int err;
err = ipv6_find_hdr(pkt->skb, &offset, priv->type, NULL, NULL); err = ipv6_find_hdr(pkt->skb, &offset, priv->type, NULL, NULL);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment