2020-06-08 10:52:21

by Geliang Tang

Subject: [PATCH net v2] mptcp: bugfix for RM_ADDR option parsing

In MPTCPOPT_RM_ADDR option parsing, the pointer "ptr" pointed to the
"Subtype" octet, the pointer "ptr+1" pointed to the "Address ID" octet:

+-------+-------+---------------+
|Subtype|(resvd)| Address ID |
+-------+-------+---------------+
| |
ptr ptr+1

We should set mp_opt->rm_id to the value of "ptr+1", not "ptr". This patch
will fix this bug.

Fixes: 3df523ab582c ("mptcp: Add ADD_ADDR handling")
Signed-off-by: Geliang Tang <[email protected]>
---
Changes in v2:
- Add "-net" subject and "Fixes" tag as Matt suggested.
---
net/mptcp/options.c | 2 ++
1 file changed, 2 insertions(+)

diff --git a/net/mptcp/options.c b/net/mptcp/options.c
index 01f1f4cf4902..490b92534afc 100644
--- a/net/mptcp/options.c
+++ b/net/mptcp/options.c
@@ -273,6 +273,8 @@ static void mptcp_parse_option(const struct sk_buff *skb,
if (opsize != TCPOLEN_MPTCP_RM_ADDR_BASE)
break;

+ ptr++;
+
mp_opt->rm_addr = 1;
mp_opt->rm_id = *ptr++;
pr_debug("RM_ADDR: id=%d", mp_opt->rm_id);
--
2.17.1

2020-06-08 11:21:56

by Matthieu Baerts

Subject: Re: [PATCH net v2] mptcp: bugfix for RM_ADDR option parsing

Hi Geliang,

On 08/06/2020 12:47, Geliang Tang wrote:
> In MPTCPOPT_RM_ADDR option parsing, the pointer "ptr" pointed to the
> "Subtype" octet, the pointer "ptr+1" pointed to the "Address ID" octet:
>
> +-------+-------+---------------+
> |Subtype|(resvd)| Address ID |
> +-------+-------+---------------+
> | |
> ptr ptr+1
>
> We should set mp_opt->rm_id to the value of "ptr+1", not "ptr". This patch
> will fix this bug.
>
> Fixes: 3df523ab582c ("mptcp: Add ADD_ADDR handling")
> Signed-off-by: Geliang Tang <[email protected]>
> ---
> Changes in v2:
> - Add "-net" subject and "Fixes" tag as Matt suggested.

Thanks for this v2! LGTM!

Reviewed-by: Matthieu Baerts <[email protected]>

Cheers,
Matt
--
Matthieu Baerts | R&D Engineer
[email protected]
Tessares SA | Hybrid Access Solutions
http://www.tessares.net
1 Avenue Jean Monnet, 1348 Louvain-la-Neuve, Belgium

2020-06-09 02:15:32

by David Miller

Subject: Re: [PATCH net v2] mptcp: bugfix for RM_ADDR option parsing

From: Geliang Tang <[email protected]>
Date: Mon, 8 Jun 2020 18:47:54 +0800

> In MPTCPOPT_RM_ADDR option parsing, the pointer "ptr" pointed to the
> "Subtype" octet, the pointer "ptr+1" pointed to the "Address ID" octet:
>
> +-------+-------+---------------+
> |Subtype|(resvd)| Address ID |
> +-------+-------+---------------+
> | |
> ptr ptr+1
>
> We should set mp_opt->rm_id to the value of "ptr+1", not "ptr". This patch
> will fix this bug.
>
> Fixes: 3df523ab582c ("mptcp: Add ADD_ADDR handling")
> Signed-off-by: Geliang Tang <[email protected]>
> ---
> Changes in v2:
> - Add "-net" subject and "Fixes" tag as Matt suggested.

Applied and queued up for v5.7 -stable, thanks!