Commit 525e26f7 authored by David S. Miller's avatar David S. Miller

[IPV4]: Do pskb_may_pull in arp_rcv() not arp_process().

parent ebb6bf1e
...@@ -630,12 +630,6 @@ int arp_process(struct sk_buff *skb) ...@@ -630,12 +630,6 @@ int arp_process(struct sk_buff *skb)
if (in_dev == NULL) if (in_dev == NULL)
goto out; goto out;
/* ARP header, plus 2 device addresses, plus 2 IP addresses. */
if (!pskb_may_pull(skb, (sizeof(struct arphdr) +
(2 * dev->addr_len) +
(2 * sizeof(u32)))))
goto out;
arp = skb->nh.arph; arp = skb->nh.arph;
switch (dev_type) { switch (dev_type) {
...@@ -837,6 +831,12 @@ int arp_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt) ...@@ -837,6 +831,12 @@ int arp_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt)
{ {
struct arphdr *arp = skb->nh.arph; struct arphdr *arp = skb->nh.arph;
/* ARP header, plus 2 device addresses, plus 2 IP addresses. */
if (!pskb_may_pull(skb, (sizeof(struct arphdr) +
(2 * dev->addr_len) +
(2 * sizeof(u32)))))
goto freeskb;
if (arp->ar_hln != dev->addr_len || if (arp->ar_hln != dev->addr_len ||
dev->flags & IFF_NOARP || dev->flags & IFF_NOARP ||
skb->pkt_type == PACKET_OTHERHOST || skb->pkt_type == PACKET_OTHERHOST ||
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment