]> www.infradead.org Git - users/jedix/linux-maple.git/commit
cipso: fix total option length computation
authorOndrej Mosnacek <omosnace@redhat.com>
Fri, 7 Jun 2024 16:07:52 +0000 (18:07 +0200)
committerDavid S. Miller <davem@davemloft.net>
Fri, 14 Jun 2024 07:18:49 +0000 (08:18 +0100)
commit9f36169912331fa035d7b73a91252d7c2512eb1a
treebc35423bc3355ced499aec6fd2de45ff8f93201e
parent4467c09bc7a66a17ffd84d6262d48279b26106ea
cipso: fix total option length computation

As evident from the definition of ip_options_get(), the IP option
IPOPT_END is used to pad the IP option data array, not IPOPT_NOP. Yet
the loop that walks the IP options to determine the total IP options
length in cipso_v4_delopt() doesn't take IPOPT_END into account.

Fix it by recognizing the IPOPT_END value as the end of actual options.

Fixes: 014ab19a69c3 ("selinux: Set socket NetLabel based on connection endpoint")
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/ipv4/cipso_ipv4.c