AcoSail/kernel_optimize_test
8
0
Fork 0
forked from luck/tmp_suning_uos_patched
Code Pull Requests Activity

llc: Fix length check in llc_fixup_skb().

Browse Source 
Fixes bugzilla #32872

The LLC stack pretends to support non-linear skbs but there is a
direct use of skb_tail_pointer() in llc_fixup_skb().

Use pskb_may_pull() to see if data_size bytes remain and can be
accessed linearly in the packet, instead of direct pointer checks.

Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
David S. Miller 2011-04-11 18:59:05 -07:00
parent 4a9f65f630
commit aa8673599f
1 changed files with 1 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
net/llc/llc_input.c
View File

@ -121,8 +121,7 @@ static inline int llc_fixup_skb(struct sk_buff *skb)
s32 data_size = ntohs(pdulen) - llc_len; s32 data_size = ntohs(pdulen) - llc_len;
if (data_size < 0 || if (data_size < 0 ||
((skb_tail_pointer(skb) - !pskb_may_pull(skb, data_size))
(u8 *)pdu) - llc_len) < data_size)
return 0; return 0;
if (unlikely(pskb_trim_rcsum(skb, data_size))) if (unlikely(pskb_trim_rcsum(skb, data_size)))
return 0; return 0;