diff options
| author | Avi Weiss <thnkslprpt@gmail.com> | 2026-10-31 13:41:35 +0200 |
|---|---|---|
| committer | Paolo Abeni <pabeni@redhat.com> | 2026-11-04 15:21:07 +0100 |
| commit | 24614e72df484ad50ecba98aaa88c7df2448c122 (patch) | |
| tree | f9e31a312e979483740ed35d2e31da1e6716bf12 | |
| parent | c4328134f3f7c2ce141121a8f82a5ec0cc8a709c (diff) | |
net: skbuff: reject zero MPLS TTL before decrementing
skb_mpls_dec_ttl() decrements the u8 TTL before checking whether it
expired. An incoming TTL of zero wraps to 255, causing the TC MPLS
dec_ttl action to pass an expired packet instead of dropping it.
Reject a zero TTL before the decrement while preserving the existing
behavior for TTL one and valid TTL values.
Fixes: 2a2ea50870ba ("net: sched: add mpls manipulation actions to TC")
Signed-off-by: Avi Weiss <thnkslprpt@gmail.com>
Reviewed-by: Xia Yan <yanxia@cmss.chinamobile.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20261031114135.3784868-2-thnkslprpt@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
| -rw-r--r-- | net/core/skbuff.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 68192e477ff1..8da53d5b76fc 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -6858,7 +6858,7 @@ int skb_mpls_dec_ttl(struct sk_buff *skb) lse = be32_to_cpu(mpls_hdr(skb)->label_stack_entry); ttl = (lse & MPLS_LS_TTL_MASK) >> MPLS_LS_TTL_SHIFT; - if (!--ttl) + if (!ttl || !--ttl) return -EINVAL; lse &= ~MPLS_LS_TTL_MASK; |