vxlan: check tun_info options_len properly
authorXin Long <lucien.xin@gmail.com>
Mon, 28 Oct 2019 17:24:32 +0000 (01:24 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 10 Nov 2019 10:27:46 +0000 (11:27 +0100)
commit83532eb4804964463a36b6f31ce595f202525094
tree0d309125fbedfa820e6d1dd1d6e06f8fb8c04d43
parenta8a5adbbf77952a8794f20e9ae49ed79e767d80d
vxlan: check tun_info options_len properly

[ Upstream commit eadf52cf1852196a1363044dcda22fa5d7f296f7 ]

This patch is to improve the tun_info options_len by dropping
the skb when TUNNEL_VXLAN_OPT is set but options_len is less
than vxlan_metadata. This can void a potential out-of-bounds
access on ip_tun_info.

Fixes: ee122c79d422 ("vxlan: Flow based tunneling")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/net/vxlan.c