mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-27 21:03:32 +00:00
netfilter: bridge: call pskb_may_pull in br_nf_check_hbh_len
When checking Hop-by-hop option header, if the option data is in nonlinear area, it should do pskb_may_pull instead of discarding the skb as a bad IPv6 packet. Signed-off-by: Xin Long <lucien.xin@gmail.com> Reviewed-by: Simon Horman <simon.horman@corigine.com> Acked-by: Nikolay Aleksandrov <razor@blackwall.org> Reviewed-by: Aaron Conole <aconole@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
This commit is contained in:
parent
4386b92185
commit
9ccff83b13
1 changed files with 9 additions and 5 deletions
|
@ -45,14 +45,18 @@
|
|||
*/
|
||||
static int br_nf_check_hbh_len(struct sk_buff *skb)
|
||||
{
|
||||
unsigned char *raw = (u8 *)(ipv6_hdr(skb) + 1);
|
||||
int len, off = sizeof(struct ipv6hdr);
|
||||
unsigned char *nh;
|
||||
u32 pkt_len;
|
||||
const unsigned char *nh = skb_network_header(skb);
|
||||
int off = raw - nh;
|
||||
int len = (raw[1] + 1) << 3;
|
||||
|
||||
if ((raw + len) - skb->data > skb_headlen(skb))
|
||||
if (!pskb_may_pull(skb, off + 8))
|
||||
goto bad;
|
||||
nh = (unsigned char *)(ipv6_hdr(skb) + 1);
|
||||
len = (nh[1] + 1) << 3;
|
||||
|
||||
if (!pskb_may_pull(skb, off + len))
|
||||
goto bad;
|
||||
nh = skb_network_header(skb);
|
||||
|
||||
off += 2;
|
||||
len -= 2;
|
||||
|
|
Loading…
Reference in a new issue