Re: [PATCH nf] netfilter: ip6t_rt: fix rt0_hdr parsing in rt_mt6

On Tue, Oct 12, 2021 at 12:02:04PM +0200, Florian Westphal wrote:

Xin Long [off-list ref] wrote:

quoted

In rt_mt6(), when it's a nonlinear skb, the 1st skb_header_pointer()
only copies sizeof(struct ipv6_rt_hdr) to _route that rh points to.
The access by ((const struct rt0_hdr *)rh)->reserved will overflow
the buffer. So this access should be moved below the 2nd call to
skb_header_pointer().

Besides, after the 2nd skb_header_pointer(), its return value should
also be checked, othersize, *rp may cause null-pointer-ref.

Patch looks good but I think you can just axe these pr_debug statements
instead of moving them.

Before pr_debug conversion these statments were #if-0 out, I don't think
they'll be missed if they are removed.

Agreed.