Commit 12dc96d1 authored by Changli Gao's avatar Changli Gao Committed by David S. Miller

cls_rsvp: add sanity check for the packet length

The packet length should be checked before the packet data is dereferenced.
Signed-off-by: default avatarChangli Gao <xiaosuo@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 4b95c3d4
...@@ -143,9 +143,17 @@ static int rsvp_classify(struct sk_buff *skb, struct tcf_proto *tp, ...@@ -143,9 +143,17 @@ static int rsvp_classify(struct sk_buff *skb, struct tcf_proto *tp,
u8 tunnelid = 0; u8 tunnelid = 0;
u8 *xprt; u8 *xprt;
#if RSVP_DST_LEN == 4 #if RSVP_DST_LEN == 4
struct ipv6hdr *nhptr = ipv6_hdr(skb); struct ipv6hdr *nhptr;
if (!pskb_network_may_pull(skb, sizeof(*nhptr)))
return -1;
nhptr = ipv6_hdr(skb);
#else #else
struct iphdr *nhptr = ip_hdr(skb); struct iphdr *nhptr;
if (!pskb_network_may_pull(skb, sizeof(*nhptr)))
return -1;
nhptr = ip_hdr(skb);
#endif #endif
restart: restart:
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment