Skip to content

Commit 8e60eed

Browse files
geliangtangdavem330
authored andcommitted
mptcp: bugfix for RM_ADDR option parsing
In MPTCPOPT_RM_ADDR option parsing, the pointer "ptr" pointed to the "Subtype" octet, the pointer "ptr+1" pointed to the "Address ID" octet: +-------+-------+---------------+ |Subtype|(resvd)| Address ID | +-------+-------+---------------+ | | ptr ptr+1 We should set mp_opt->rm_id to the value of "ptr+1", not "ptr". This patch will fix this bug. Fixes: 3df523a ("mptcp: Add ADD_ADDR handling") Signed-off-by: Geliang Tang <[email protected]> Reviewed-by: Matthieu Baerts <[email protected]> Signed-off-by: David S. Miller <[email protected]>
1 parent 3763a24 commit 8e60eed

File tree

1 file changed

+2
-0
lines changed

1 file changed

+2
-0
lines changed

net/mptcp/options.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -273,6 +273,8 @@ static void mptcp_parse_option(const struct sk_buff *skb,
273273
if (opsize != TCPOLEN_MPTCP_RM_ADDR_BASE)
274274
break;
275275

276+
ptr++;
277+
276278
mp_opt->rm_addr = 1;
277279
mp_opt->rm_id = *ptr++;
278280
pr_debug("RM_ADDR: id=%d", mp_opt->rm_id);

0 commit comments

Comments
 (0)