diff options
| author | Ehsan Mohandesi <emohandesi@linux.microsoft.com> | 2023-05-18 11:24:38 -0700 |
|---|---|---|
| committer | Tom Rini <trini@konsulko.com> | 2023-07-27 13:39:07 -0400 |
| commit | a29df56eab4ad7957649834c1120c69ce03115ee (patch) | |
| tree | a7f4fb8491b7bb9842454d0ac772f6fff94dbbc5 /net | |
| parent | c98c401dfb485b39c7453a4147b17cd4b8d10c67 (diff) | |
| download | u-boot-a29df56eab4ad7957649834c1120c69ce03115ee.tar.gz u-boot-a29df56eab4ad7957649834c1120c69ce03115ee.tar.bz2 u-boot-a29df56eab4ad7957649834c1120c69ce03115ee.zip | |
net: ipv6: router advertisement message length should be within limits
The argument len passed to function process_ra is the length of the IPv6
router advertisement message and needs to be between 0 and MTU because
it is assigned to remaining_option_len and used as a loop variable.
Addresses-Coverity-ID: 450971 ("TAINTED_SCALAR")
Signed-off-by: Ehsan Mohandesi <emohandesi@linux.microsoft.com>
Reviewed-by: Viacheslav Mitrofanov <v.v.mitrofanov@yadro.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
Diffstat (limited to 'net')
| -rw-r--r-- | net/ndisc.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/net/ndisc.c b/net/ndisc.c index 0b27779ce5..d1cec0601c 100644 --- a/net/ndisc.c +++ b/net/ndisc.c @@ -382,6 +382,8 @@ int process_ra(struct ip6_hdr *ip6, int len) unsigned char type = 0; struct icmp6_ra_prefix_info *prefix = NULL; + if (len > ETH_MAX_MTU) + return -EMSGSIZE; /* Ignore the packet if router lifetime is 0. */ if (!icmp->icmp6_rt_lifetime) return -EOPNOTSUPP; |