Re: [PATCH]: fixed kernel panic when trying to find tcp option

["David S. Miller" <davem@davemloft.net>]

On Wed, 15 Sep 2004 08:43:35 -0700
"David S. Miller" <davem@davemloft.net> wrote:

> All callers, well there is only one, make sure optlen is
> non-zero.
> 
> Here is the call site in tcp_match():
> 
> 	if (tcpinfo->option) {
> 		if (th->doff * 4 < sizeof(_tcph)) {
> 			*hotdrop = 1;
> 			return 0;
> 		}
> 		if (!tcp_find_option(tcpinfo->option, skb,
> 				     th->doff*4 - sizeof(_tcph),
> 				     tcpinfo->invflags & IPT_TCP_INV_OPTION,
> 				     hotdrop))
> 			return 0;
> 	}
> 
> If the optlen would be zero, second if() passes and we
> set *hotdrop to 1 and return.

Wait, that is the bug, the condition test has an
off-by-one error, it should read:

		if (th->doff * 4 <= sizeof(_tcph))

I will fix this in my tree.