netfilter: ipv6: fix crash caused by ipv6_find_hdr()
authorJP Abgrall <jpa@google.com>
Thu, 29 Sep 2011 22:36:49 +0000 (15:36 -0700)
committerJohn Stultz <john.stultz@linaro.org>
Tue, 16 Feb 2016 21:51:32 +0000 (13:51 -0800)
commit4a0851b8b57ec8c873e336d3ac24fb6593ab1c86
tree725dde5fe86880ca51d01baaff207dccefe9d707
parent564578ba4578682401bd4416fcf42555dc056434
netfilter: ipv6: fix crash caused by ipv6_find_hdr()

When calling:
    ipv6_find_hdr(skb, &thoff, -1, NULL)
on a fragmented packet, thoff would be left with a random
value causing callers to read random memory offsets with:
    skb_header_pointer(skb, thoff, ...)

Now we force ipv6_find_hdr() to return a failure in this case.
Calling:
  ipv6_find_hdr(skb, &thoff, -1, &fragoff)
will set fragoff as expected, and not return a failure.

Change-Id: Ib474e8a4267dd2b300feca325811330329684a88
Signed-off-by: JP Abgrall <jpa@google.com>
net/ipv6/exthdrs_core.c