Messages in this thread Patch in this message | | | From | Geliang Tang <> | Subject | [PATCH] mptcp: bugfix for RM_ADDR option parsing | Date | Mon, 8 Jun 2020 15:48:10 +0800 |
| |
In MPTCPOPT_RM_ADDR option parsing, the pointer "ptr" pointed to the "Subtype" octet, the pointer "ptr+1" pointed to the "Address ID" octet:
+-------+-------+---------------+ |Subtype|(resvd)| Address ID | +-------+-------+---------------+ | | ptr ptr+1
We should set mp_opt->rm_id to the value of "ptr+1", not "ptr". This patch will fix this bug.
Signed-off-by: Geliang Tang <geliangtang@gmail.com> --- net/mptcp/options.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/net/mptcp/options.c b/net/mptcp/options.c index 01f1f4cf4902..490b92534afc 100644 --- a/net/mptcp/options.c +++ b/net/mptcp/options.c @@ -273,6 +273,8 @@ static void mptcp_parse_option(const struct sk_buff *skb, if (opsize != TCPOLEN_MPTCP_RM_ADDR_BASE) break; + ptr++; + mp_opt->rm_addr = 1; mp_opt->rm_id = *ptr++; pr_debug("RM_ADDR: id=%d", mp_opt->rm_id); -- 2.17.1
| |