tree 8b27a97b3cd6f554dd2208efd6800e4ebd2f045a
parent 6fe4b76beddd115aea5e11db3c7ea713b800b444
author Eric Dumazet <edumazet@google.com> 1486279135 -0800
committer Mark Salyzyn <salyzyn@google.com> 1497281691 -0700

BACKPORT: ip6_gre: fix ip6gre_err() invalid reads

Andrey Konovalov reported out of bound accesses in ip6gre_err()

If GRE flags contains GRE_KEY, the following expression
*(((__be32 *)p) + (grehlen / 4) - 1)

accesses data ~40 bytes after the expected point, since
grehlen includes the size of IPv6 headers.

Let's use a "struct gre_base_hdr *greh" pointer to make this
code more readable.

p[1] becomes greh->protocol.
grhlen is the GRE header length.

Fixes: c12b395a4664 ("gre: Support GRE over IPv6")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Roberto Pereira <rpere@google.com>
(cherry picked from commit 7892032cfe67f4bde6fc2ee967e45a8fbaf33756)
Bug:37871211
Change-Id: I839afd0948805b98e1aa6cbaca56f2e443f303af