From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:60248 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751669AbdIUMFk (ORCPT ); Thu, 21 Sep 2017 08:05:40 -0400 Subject: Patch "ip6_gre: fix endianness errors in ip6gre_err" has been added to the 3.18-stable tree To: sd@queasysnail.net, davem@davemloft.net, edumazet@google.com, gregkh@linuxfoundation.org Cc: , From: Date: Thu, 21 Sep 2017 14:05:50 +0200 Message-ID: <150599555021481@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled ip6_gre: fix endianness errors in ip6gre_err to the 3.18-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: ip6_gre-fix-endianness-errors-in-ip6gre_err.patch and it can be found in the queue-3.18 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From d1e158e2d7a0a91110b206653f0e02376e809150 Mon Sep 17 00:00:00 2001 From: Sabrina Dubroca Date: Wed, 4 Feb 2015 15:25:09 +0100 Subject: ip6_gre: fix endianness errors in ip6gre_err From: Sabrina Dubroca commit d1e158e2d7a0a91110b206653f0e02376e809150 upstream. info is in network byte order, change it back to host byte order before use. In particular, the current code sets the MTU of the tunnel to a wrong (too big) value. Fixes: c12b395a4664 ("gre: Support GRE over IPv6") Signed-off-by: Sabrina Dubroca Acked-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/ipv6/ip6_gre.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/net/ipv6/ip6_gre.c +++ b/net/ipv6/ip6_gre.c @@ -421,7 +421,7 @@ static void ip6gre_err(struct sk_buff *s if (code == ICMPV6_HDR_FIELD) teli = ip6_tnl_parse_tlv_enc_lim(skb, skb->data); - if (teli && teli == info - 2) { + if (teli && teli == be32_to_cpu(info) - 2) { tel = (struct ipv6_tlv_tnl_enc_lim *) &skb->data[teli]; if (tel->encap_limit == 0) { net_warn_ratelimited("%s: Too small encapsulation limit or routing loop in tunnel!\n", @@ -433,7 +433,7 @@ static void ip6gre_err(struct sk_buff *s } break; case ICMPV6_PKT_TOOBIG: - mtu = info - offset; + mtu = be32_to_cpu(info) - offset; if (mtu < IPV6_MIN_MTU) mtu = IPV6_MIN_MTU; t->dev->mtu = mtu; Patches currently in stable-queue which might be from sd@queasysnail.net are queue-3.18/ip6_gre-fix-endianness-errors-in-ip6gre_err.patch queue-3.18/ipv6-fix-memory-leak-with-multiple-tables-during-netns-destruction.patch