diff options
| author | Ingo Molnar <mingo@kernel.org> | 2019-02-04 08:45:42 +0100 |
|---|---|---|
| committer | Ingo Molnar <mingo@kernel.org> | 2019-02-04 08:45:42 +0100 |
| commit | 98cb621081705e2244ef6c265ff8a9f2208c7e2a (patch) | |
| tree | 6205be47a83d54d3e35e049b67973244120f8bd6 /net/ipv4/fou.c | |
| parent | b844ff366f06a2bcecfbd053b4d4a472e670dec8 (diff) | |
| parent | 9dff0aa95a324e262ffb03f425d00e4751f3294e (diff) | |
| download | linux-98cb621081705e2244ef6c265ff8a9f2208c7e2a.tar.gz linux-98cb621081705e2244ef6c265ff8a9f2208c7e2a.tar.bz2 linux-98cb621081705e2244ef6c265ff8a9f2208c7e2a.zip | |
Merge branch 'perf/urgent' into perf/core, to pick up fixes
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Diffstat (limited to 'net/ipv4/fou.c')
| -rw-r--r-- | net/ipv4/fou.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/net/ipv4/fou.c b/net/ipv4/fou.c index 632863541082..437070d1ffb1 100644 --- a/net/ipv4/fou.c +++ b/net/ipv4/fou.c @@ -1020,10 +1020,11 @@ static int gue_err(struct sk_buff *skb, u32 info) { int transport_offset = skb_transport_offset(skb); struct guehdr *guehdr; - size_t optlen; + size_t len, optlen; int ret; - if (skb->len < sizeof(struct udphdr) + sizeof(struct guehdr)) + len = sizeof(struct udphdr) + sizeof(struct guehdr); + if (!pskb_may_pull(skb, len)) return -EINVAL; guehdr = (struct guehdr *)&udp_hdr(skb)[1]; @@ -1058,6 +1059,10 @@ static int gue_err(struct sk_buff *skb, u32 info) optlen = guehdr->hlen << 2; + if (!pskb_may_pull(skb, len + optlen)) + return -EINVAL; + + guehdr = (struct guehdr *)&udp_hdr(skb)[1]; if (validate_gue_flags(guehdr, optlen)) return -EINVAL; |