From: Greg Kroah-Hartman Date: Sat, 9 Sep 2023 22:18:05 +0000 (+0100) Subject: fix up dccp patch for 4.19 and 4.14 X-Git-Tag: v6.1.53~55 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=f7da2ab03a1ed9336e868eceabac57ba62d59c3e;p=thirdparty%2Fkernel%2Fstable-queue.git fix up dccp patch for 4.19 and 4.14 --- diff --git a/queue-4.14/dccp-fix-out-of-bounds-access-in-dccp-error-handler.patch b/queue-4.14/dccp-fix-out-of-bounds-access-in-dccp-error-handler.patch index ccf2a80abfc..6175ac58ffb 100644 --- a/queue-4.14/dccp-fix-out-of-bounds-access-in-dccp-error-handler.patch +++ b/queue-4.14/dccp-fix-out-of-bounds-access-in-dccp-error-handler.patch @@ -44,7 +44,7 @@ Signed-off-by: Greg Kroah-Hartman - BUILD_BUG_ON(offsetofend(struct dccp_hdr, dccph_dport) > 8); + dh = (struct dccp_hdr *)(skb->data + offset); + if (!pskb_may_pull(skb, offset + __dccp_basic_hdr_len(dh))) -+ return -EINVAL; ++ return; + iph = (struct iphdr *)skb->data; dh = (struct dccp_hdr *)(skb->data + offset); @@ -77,7 +77,7 @@ Signed-off-by: Greg Kroah-Hartman - BUILD_BUG_ON(offsetofend(struct dccp_hdr, dccph_dport) > 8); + dh = (struct dccp_hdr *)(skb->data + offset); + if (!pskb_may_pull(skb, offset + __dccp_basic_hdr_len(dh))) -+ return -EINVAL; ++ return; + hdr = (const struct ipv6hdr *)skb->data; dh = (struct dccp_hdr *)(skb->data + offset); diff --git a/queue-4.19/dccp-fix-out-of-bounds-access-in-dccp-error-handler.patch b/queue-4.19/dccp-fix-out-of-bounds-access-in-dccp-error-handler.patch index ccf2a80abfc..6175ac58ffb 100644 --- a/queue-4.19/dccp-fix-out-of-bounds-access-in-dccp-error-handler.patch +++ b/queue-4.19/dccp-fix-out-of-bounds-access-in-dccp-error-handler.patch @@ -44,7 +44,7 @@ Signed-off-by: Greg Kroah-Hartman - BUILD_BUG_ON(offsetofend(struct dccp_hdr, dccph_dport) > 8); + dh = (struct dccp_hdr *)(skb->data + offset); + if (!pskb_may_pull(skb, offset + __dccp_basic_hdr_len(dh))) -+ return -EINVAL; ++ return; + iph = (struct iphdr *)skb->data; dh = (struct dccp_hdr *)(skb->data + offset); @@ -77,7 +77,7 @@ Signed-off-by: Greg Kroah-Hartman - BUILD_BUG_ON(offsetofend(struct dccp_hdr, dccph_dport) > 8); + dh = (struct dccp_hdr *)(skb->data + offset); + if (!pskb_may_pull(skb, offset + __dccp_basic_hdr_len(dh))) -+ return -EINVAL; ++ return; + hdr = (const struct ipv6hdr *)skb->data; dh = (struct dccp_hdr *)(skb->data + offset);