diff options
author | David S. Miller <davem@davemloft.net> | 2009-10-29 21:28:59 -0700 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2009-10-29 21:28:59 -0700 |
commit | 0519d83d83ed485b5a1f9222ff69d7d6c9bb8a01 (patch) | |
tree | 2e336be8a4bd2e59bcd4b69b00feb77c6672a9cb /net/ipv4 | |
parent | 38bfd8f5bec496e8e0db8849e01c99a33479418a (diff) | |
parent | b5dd884e682cae6b8c037f9d11f3b623b4cf2011 (diff) | |
download | linux-stable-0519d83d83ed485b5a1f9222ff69d7d6c9bb8a01.tar.gz linux-stable-0519d83d83ed485b5a1f9222ff69d7d6c9bb8a01.tar.bz2 linux-stable-0519d83d83ed485b5a1f9222ff69d7d6c9bb8a01.zip |
Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6
Diffstat (limited to 'net/ipv4')
-rw-r--r-- | net/ipv4/raw.c | 24 |
1 files changed, 17 insertions, 7 deletions
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c index 9ef8c0829a77..ce154b47f1da 100644 --- a/net/ipv4/raw.c +++ b/net/ipv4/raw.c @@ -351,13 +351,24 @@ static int raw_send_hdrinc(struct sock *sk, void *from, size_t length, skb->ip_summed = CHECKSUM_NONE; skb->transport_header = skb->network_header; - err = memcpy_fromiovecend((void *)iph, from, 0, length); - if (err) - goto error_fault; + err = -EFAULT; + if (memcpy_fromiovecend((void *)iph, from, 0, length)) + goto error_free; - /* We don't modify invalid header */ iphlen = iph->ihl * 4; - if (iphlen >= sizeof(*iph) && iphlen <= length) { + + /* + * We don't want to modify the ip header, but we do need to + * be sure that it won't cause problems later along the network + * stack. Specifically we want to make sure that iph->ihl is a + * sane value. If ihl points beyond the length of the buffer passed + * in, reject the frame as invalid + */ + err = -EINVAL; + if (iphlen > length) + goto error_free; + + if (iphlen >= sizeof(*iph)) { if (!iph->saddr) iph->saddr = rt->rt_src; iph->check = 0; @@ -380,8 +391,7 @@ static int raw_send_hdrinc(struct sock *sk, void *from, size_t length, out: return 0; -error_fault: - err = -EFAULT; +error_free: kfree_skb(skb); error: IP_INC_STATS(net, IPSTATS_MIB_OUTDISCARDS); |