mptcp: bugfix for RM_ADDR option parsing

[ Upstream commit 8e60eed6b38e464e8c9d68f9caecafaa554dffe0 ]

In MPTCPOPT_RM_ADDR option parsing, the pointer "ptr" pointed to the
"Subtype" octet, the pointer "ptr+1" pointed to the "Address ID" octet:

  +-------+-------+---------------+
  |Subtype|(resvd)|   Address ID  |
  +-------+-------+---------------+
  |               |
 ptr            ptr+1

We should set mp_opt->rm_id to the value of "ptr+1", not "ptr". This patch
will fix this bug.

Fixes: 3df523ab582c ("mptcp: Add ADD_ADDR handling")
Signed-off-by: Geliang Tang <geliangtang@gmail.com>
Reviewed-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/net/mptcp/options.c b/net/mptcp/options.c
index 7793b6011fa7bb5e241074683e567de8b8896a5d..1c20dd14b2aa29acd9ba14620a4e07dcfd48148b 100644 (file)
--- a/net/mptcp/options.c
+++ b/net/mptcp/options.c
@@ -273,6 +273,8 @@ static void mptcp_parse_option(const struct sk_buff *skb,
                if (opsize != TCPOLEN_MPTCP_RM_ADDR_BASE)
                        break;
 
+               ptr++;
+
                mp_opt->rm_addr = 1;
                mp_opt->rm_id = *ptr++;
                pr_debug("RM_ADDR: id=%d", mp_opt->rm_id);