commit 0a100fa8206ffa6039caf9ce02754060b6faf2ea
author Prashantsinh Parmar <prashantsinh.parmar@fairphone.partners> Wed Mar 22 23:16:43 2023 +0530
committer Prashantsinh Parmar <prashantsinh.parmar@fairphone.partners> Wed Mar 22 23:16:43 2023 +0530
tree f08826c33ca9f4226267fedca305aa88187f1db6
parent 4602e583f2bcce452b0194edeecb884d6449d138
parent f9b8314c64640cd10c7b14ce9d2a11a0dc02a941

Merge branch 'android-4.9-q' into int/11/fp3

* android-4.9-q:
  UPSTREAM: ipv6: raw: Deduct extension header length in rawv6_push_pending_frames
  UPSTREAM: netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.

Change-Id: Id7ae4683925aa9b2405f05d79c8c146cf0430cf2

net/ipv6/raw.c

diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index f3caf95..a91e643 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -539,6 +539,7 @@
 static int rawv6_push_pending_frames(struct sock *sk, struct flowi6 *fl6,
 				     struct raw6_sock *rp)
 {
+	struct ipv6_txoptions *opt;
 	struct sk_buff *skb;
 	int err = 0;
 	int offset;
@@ -556,6 +557,9 @@
 
 	offset = rp->offset;
 	total_len = inet_sk(sk)->cork.base.length;
+	opt = inet6_sk(sk)->cork.opt;
+	total_len -= opt ? opt->opt_flen : 0;
+
 	if (offset >= total_len - 1) {
 		err = -EINVAL;
 		ip6_flush_pending_frames(sk);

net/netfilter/ipset/ip_set_bitmap_ip.c

diff --git a/net/netfilter/ipset/ip_set_bitmap_ip.c b/net/netfilter/ipset/ip_set_bitmap_ip.c
index a4c104a..45cff8b 100644
--- a/net/netfilter/ipset/ip_set_bitmap_ip.c
+++ b/net/netfilter/ipset/ip_set_bitmap_ip.c
@@ -301,8 +301,8 @@
 			return -IPSET_ERR_BITMAP_RANGE;
 
 		pr_debug("mask_bits %u, netmask %u\n", mask_bits, netmask);
-		hosts = 2 << (32 - netmask - 1);
-		elements = 2 << (netmask - mask_bits - 1);
+		hosts = 2U << (32 - netmask - 1);
+		elements = 2UL << (netmask - mask_bits - 1);
 	}
 	if (elements > IPSET_BITMAP_MAX_RANGE + 1)
 		return -IPSET_ERR_BITMAP_RANGE_SIZE;