On Wed, 2019-01-16 at 17:40 +0100, Lorenzo Bianconi wrote:
> Does '((*(u8 *)options & 0xF0) != 0x40)' have the same issue?
(cc-ing Jiri Benc, he probably knows more on this part)
in my opinion, yes, theoretically there might be situations where the
above line reads 1 byte outside the linear area of the skb. Probably the
fix for this is unrelated, and needs to be done in another patch.
For the record, git annotate on this line shows
00b203402984 ("gre: remove superfluous pskb_may_pull")
but I think it was reading out of the linear area also before that commit,
and that commit is correct, because pskb_may_pull() is called later using
the return value of gre_parse_header().
(other eyes over here are welcome :) )
--
davide
