netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [patch] ipv6: pointer math error in ip6_tnl_parse_tlv_enc_lim()
@ 2017-02-01  8:46 Dan Carpenter
  2017-02-01 15:26 ` Eric Dumazet
  2017-02-01 17:31 ` David Miller
  0 siblings, 2 replies; 3+ messages in thread
From: Dan Carpenter @ 2017-02-01  8:46 UTC (permalink / raw)
  To: David S. Miller, Eric Dumazet
  Cc: Alexey Kuznetsov, James Morris, Hideaki YOSHIFUJI,
	Patrick McHardy, netdev, kernel-janitors

Casting is a high precedence operation but "off" and "i" are in terms of
bytes so we need to have some parenthesis here.

Fixes: fbfa743a9d2a ("ipv6: fix ip6_tnl_parse_tlv_enc_lim()")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index ff8ee06491c3..75fac933c209 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -441,7 +441,7 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw)
 				if (i + sizeof(*tel) > optlen)
 					break;
 
-				tel = (struct ipv6_tlv_tnl_enc_lim *) skb->data + off + i;
+				tel = (struct ipv6_tlv_tnl_enc_lim *)(skb->data + off + i);
 				/* return index of option if found and valid */
 				if (tel->type == IPV6_TLV_TNL_ENCAP_LIMIT &&
 				    tel->length == 1)

^ permalink raw reply related	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2017-02-01 17:31 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-02-01  8:46 [patch] ipv6: pointer math error in ip6_tnl_parse_tlv_enc_lim() Dan Carpenter
2017-02-01 15:26 ` Eric Dumazet
2017-02-01 17:31 ` David Miller

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).