netdev - ipv6: fix headroom calculation in udp6_ufo

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <D00A5DFD97C44C4D820FC3A847C5D5750730630F@IRVEXCHMB14.corp.ad.broadcom.com>
Date:	Fri, 13 Dec 2013 13:01:59 +0000
From:	Mark Hambleton <mark.hambleton@...adcom.com>
To:	'Pravin B Shelar' <pshelar@...ira.com>,
	'Saran Neti' <Saran.Neti@...us.com>,
	"'David S. Miller'" <davem@...emloft.net>,
	'Greg Kroah-Hartman' <gregkh@...uxfoundation.org>,
	'Hannes Frederic Sowa' <hannes@...essinduktion.org>
CC:	"Mark Brown (broonie@...aro.org)" <broonie@...aro.org>,
	"'netdev@...r.kernel.org'" <netdev@...r.kernel.org>,
	"'stable@...r.kernel.org'" <stable@...r.kernel.org>
Subject: ipv6: fix headroom calculation in udp6_ufo_fragment

Hi, 

Following a recent commit to LTS and upstream  I see the following warning emitted on an ARM32 build:

net/ipv6/udp_offload.c: In function 'udp6_ufo_fragment':
net/ipv6/udp_offload.c:88:22: error: comparison between pointer and integer [-Werror]
  if (skb->mac_header < (tnl_hlen + frag_hdr_sz)) {
                      ^
cc1: all warnings being treated as errors
make[2]: *** [net/ipv6/udp_offload.o] Error 1
make[1]: *** [net/ipv6] Error 2

 The commit made the following changes:

-       if (skb_headroom(skb) < (tnl_hlen + frag_hdr_sz)) {
+       if (skb->mac_header < (tnl_hlen + frag_hdr_sz)) {

Now, because of some defines in skbuff.h :

#if BITS_PER_LONG > 32
#define NET_SKBUFF_DATA_USES_OFFSET 1
#endif

#ifdef NET_SKBUFF_DATA_USES_OFFSET
typedef unsigned int sk_buff_data_t;
#else
typedef unsigned char *sk_buff_data_t;
#endif

On an ARM32 system sk_buff_data_t would be a pointer (long being 32 bits), meaning that skb->mac_header is a pointer and that  you are comparing a pointer against a length, which doesn't look like it is correct to me?

I can see how this works when NET_SKBUFF_DATA_USES_OFFSET is defined, but is there a way to do this that works for both cases?

Hope this makes sense, 

Mark

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html