mirror of
https://github.com/torvalds/linux
synced 2024-10-06 11:25:23 +00:00
cipso: fix total option length computation
As evident from the definition of ip_options_get(), the IP option
IPOPT_END is used to pad the IP option data array, not IPOPT_NOP. Yet
the loop that walks the IP options to determine the total IP options
length in cipso_v4_delopt() doesn't take IPOPT_END into account.
Fix it by recognizing the IPOPT_END value as the end of actual options.
Fixes: 014ab19a69
("selinux: Set socket NetLabel based on connection endpoint")
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
4467c09bc7
commit
9f36169912
|
@ -2013,12 +2013,16 @@ static int cipso_v4_delopt(struct ip_options_rcu __rcu **opt_ptr)
|
|||
* from there we can determine the new total option length */
|
||||
iter = 0;
|
||||
optlen_new = 0;
|
||||
while (iter < opt->opt.optlen)
|
||||
if (opt->opt.__data[iter] != IPOPT_NOP) {
|
||||
while (iter < opt->opt.optlen) {
|
||||
if (opt->opt.__data[iter] == IPOPT_END) {
|
||||
break;
|
||||
} else if (opt->opt.__data[iter] == IPOPT_NOP) {
|
||||
iter++;
|
||||
} else {
|
||||
iter += opt->opt.__data[iter + 1];
|
||||
optlen_new = iter;
|
||||
} else
|
||||
iter++;
|
||||
}
|
||||
}
|
||||
hdr_delta = opt->opt.optlen;
|
||||
opt->opt.optlen = (optlen_new + 3) & ~3;
|
||||
hdr_delta -= opt->opt.optlen;
|
||||
|
|
Loading…
Reference in a new issue