xfrm6: fix the proto and ports decode of sctp protocol
[firefly-linux-kernel-4.4.55.git] / net / ipv6 / xfrm6_policy.c
index 97ab068e8ccc10be9d1ee27ec3b4a081322bb307..3a3c677bc0f2571b9679e5b9015ec15c6951e3b2 100644 (file)
@@ -157,7 +157,8 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
        ipv6_addr_copy(&fl->fl6_dst, reverse ? &hdr->saddr : &hdr->daddr);
        ipv6_addr_copy(&fl->fl6_src, reverse ? &hdr->daddr : &hdr->saddr);
 
-       while (pskb_may_pull(skb, nh + offset + 1 - skb->data)) {
+       while (nh + offset + 1 < skb->data ||
+              pskb_may_pull(skb, nh + offset + 1 - skb->data)) {
                nh = skb_network_header(skb);
                exthdr = (struct ipv6_opt_hdr *)(nh + offset);
 
@@ -177,7 +178,8 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
                case IPPROTO_TCP:
                case IPPROTO_SCTP:
                case IPPROTO_DCCP:
-                       if (!onlyproto && pskb_may_pull(skb, nh + offset + 4 - skb->data)) {
+                       if (!onlyproto && (nh + offset + 4 < skb->data ||
+                            pskb_may_pull(skb, nh + offset + 4 - skb->data))) {
                                __be16 *ports = (__be16 *)exthdr;
 
                                fl->fl_ip_sport = ports[!!reverse];
@@ -272,7 +274,7 @@ static void xfrm6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
 
 static struct dst_ops xfrm6_dst_ops = {
        .family =               AF_INET6,
-       .protocol =             __constant_htons(ETH_P_IPV6),
+       .protocol =             cpu_to_be16(ETH_P_IPV6),
        .gc =                   xfrm6_garbage_collect,
        .update_pmtu =          xfrm6_update_pmtu,
        .destroy =              xfrm6_dst_destroy,