mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-30 14:19:16 +00:00
cls_rsvp: add sanity check for the packet length
The packet length should be checked before the packet data is dereferenced. Signed-off-by: Changli Gao <xiaosuo@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
4b95c3d40d
commit
12dc96d167
1 changed files with 10 additions and 2 deletions
|
@ -143,9 +143,17 @@ static int rsvp_classify(struct sk_buff *skb, struct tcf_proto *tp,
|
||||||
u8 tunnelid = 0;
|
u8 tunnelid = 0;
|
||||||
u8 *xprt;
|
u8 *xprt;
|
||||||
#if RSVP_DST_LEN == 4
|
#if RSVP_DST_LEN == 4
|
||||||
struct ipv6hdr *nhptr = ipv6_hdr(skb);
|
struct ipv6hdr *nhptr;
|
||||||
|
|
||||||
|
if (!pskb_network_may_pull(skb, sizeof(*nhptr)))
|
||||||
|
return -1;
|
||||||
|
nhptr = ipv6_hdr(skb);
|
||||||
#else
|
#else
|
||||||
struct iphdr *nhptr = ip_hdr(skb);
|
struct iphdr *nhptr;
|
||||||
|
|
||||||
|
if (!pskb_network_may_pull(skb, sizeof(*nhptr)))
|
||||||
|
return -1;
|
||||||
|
nhptr = ip_hdr(skb);
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
restart:
|
restart:
|
||||||
|
|
Loading…
Reference in a new issue