summaryrefslogtreecommitdiff
path: root/arch
diff options
context:
space:
mode:
authorRobin Murphy <robin.murphy@arm.com>2020-07-30 12:56:49 +0300
committerWill Deacon <will@kernel.org>2020-07-30 19:01:38 +0300
commit05fb3dbda187bbd9cc1cd0e97e5d6595af570ac6 (patch)
tree6997394455a6b7db8d4617380a8a52ca79f4ac9b /arch
parent835d1c3a98799914db8aee0973018af21128cd1e (diff)
downloadlinux-05fb3dbda187bbd9cc1cd0e97e5d6595af570ac6.tar.xz
arm64: csum: Fix handling of bad packets
Although iph is expected to point to at least 20 bytes of valid memory, ihl may be bogus, for example on reception of a corrupt packet. If it happens to be less than 5, we really don't want to run away and dereference 16GB worth of memory until it wraps back to exactly zero... Fixes: 0e455d8e80aa ("arm64: Implement optimised IP checksum helpers") Reported-by: guodeqing <geffrey.guo@huawei.com> Signed-off-by: Robin Murphy <robin.murphy@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
Diffstat (limited to 'arch')
-rw-r--r--arch/arm64/include/asm/checksum.h5
1 files changed, 3 insertions, 2 deletions
diff --git a/arch/arm64/include/asm/checksum.h b/arch/arm64/include/asm/checksum.h
index b6f7bc6da5fb..93a161b3bf3f 100644
--- a/arch/arm64/include/asm/checksum.h
+++ b/arch/arm64/include/asm/checksum.h
@@ -24,16 +24,17 @@ static inline __sum16 ip_fast_csum(const void *iph, unsigned int ihl)
{
__uint128_t tmp;
u64 sum;
+ int n = ihl; /* we want it signed */
tmp = *(const __uint128_t *)iph;
iph += 16;
- ihl -= 4;
+ n -= 4;
tmp += ((tmp >> 64) | (tmp << 64));
sum = tmp >> 64;
do {
sum += *(const u32 *)iph;
iph += 4;
- } while (--ihl);
+ } while (--n > 0);
sum += ((sum >> 32) | (sum << 32));
return csum_fold((__force u32)(sum >> 32));