Re: [PATCH]: fixed kernel panic when trying to find tcp option

["David S. Miller" <davem@davemloft.net>]

On Wed, 15 Sep 2004 20:36:44 +0900 (JST)
Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp> wrote:

> This patch fixed panic on 2.6.9-rc2 when trying to find tcp option
> in the packet which has no option.
> 
> If not fixed yet, please apply this patch.

This patch is unnecessary, you might want to explain how
this condition can possibly occur.

All callers, well there is only one, make sure optlen is
non-zero.

Here is the call site in tcp_match():

	if (tcpinfo->option) {
		if (th->doff * 4 < sizeof(_tcph)) {
			*hotdrop = 1;
			return 0;
		}
		if (!tcp_find_option(tcpinfo->option, skb,
				     th->doff*4 - sizeof(_tcph),
				     tcpinfo->invflags & IPT_TCP_INV_OPTION,
				     hotdrop))
			return 0;
	}

If the optlen would be zero, second if() passes and we
set *hotdrop to 1 and return.

This is why tcp_find_option() uses BUG_ON(!optlen), it means
that callers must check this.

You must be changing this code or using it is some other way,
if so you must make sure you check for non-zero optlen before
invoking tcp_find_option().