From: Geliang Tang geliangtang@gmail.com
[ Upstream commit 8e60eed6b38e464e8c9d68f9caecafaa554dffe0 ]
In MPTCPOPT_RM_ADDR option parsing, the pointer "ptr" pointed to the "Subtype" octet, the pointer "ptr+1" pointed to the "Address ID" octet:
+-------+-------+---------------+ |Subtype|(resvd)| Address ID | +-------+-------+---------------+ | | ptr ptr+1
We should set mp_opt->rm_id to the value of "ptr+1", not "ptr". This patch will fix this bug.
Fixes: 3df523ab582c ("mptcp: Add ADD_ADDR handling") Signed-off-by: Geliang Tang geliangtang@gmail.com Reviewed-by: Matthieu Baerts matthieu.baerts@tessares.net Signed-off-by: David S. Miller davem@davemloft.net Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- net/mptcp/options.c | 2 ++ 1 file changed, 2 insertions(+)
--- a/net/mptcp/options.c +++ b/net/mptcp/options.c @@ -273,6 +273,8 @@ static void mptcp_parse_option(const str if (opsize != TCPOLEN_MPTCP_RM_ADDR_BASE) break;
+ ptr++; + mp_opt->rm_addr = 1; mp_opt->rm_id = *ptr++; pr_debug("RM_ADDR: id=%d", mp_opt->rm_id);