diff options
| author | Geliang Tang | 2020-06-08 18:47:54 +0800 |
|---|---|---|
| committer | David S. Miller | 2020-06-08 19:09:41 -0700 |
| commit | 8e60eed6b38e464e8c9d68f9caecafaa554dffe0 (patch) | |
| tree | a73fec9f2f89599077b500f123242a131af53072 | |
| parent | 3763a24c727ecf236358a81ee749e5fcab1c972a (diff) | |
mptcp: bugfix for RM_ADDR option parsing
In MPTCPOPT_RM_ADDR option parsing, the pointer "ptr" pointed to the
"Subtype" octet, the pointer "ptr+1" pointed to the "Address ID" octet:
+-------+-------+---------------+
|Subtype|(resvd)| Address ID |
+-------+-------+---------------+
| |
ptr ptr+1
We should set mp_opt->rm_id to the value of "ptr+1", not "ptr". This patch
will fix this bug.
Fixes: 3df523ab582c ("mptcp: Add ADD_ADDR handling")
Signed-off-by: Geliang Tang <geliangtang@gmail.com>
Reviewed-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | net/mptcp/options.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/net/mptcp/options.c b/net/mptcp/options.c index 01f1f4cf4902..490b92534afc 100644 --- a/net/mptcp/options.c +++ b/net/mptcp/options.c @@ -273,6 +273,8 @@ static void mptcp_parse_option(const struct sk_buff *skb, if (opsize != TCPOLEN_MPTCP_RM_ADDR_BASE) break; + ptr++; + mp_opt->rm_addr = 1; mp_opt->rm_id = *ptr++; pr_debug("RM_ADDR: id=%d", mp_opt->rm_id); |