[patch 20/20] Fix UDP header pointer after pskb_trim_rcsum()

Greg KH
2007-03-10T06:21:57Z

[-- Attachment #1: fix-udp-header-pointer-after-pskb_trim_rcsum.patch --]
[-- Type: text/plain, Size: 692 bytes --]

-stable review patch. If anyone has any objections, please let us know.

------------------

From: Herbert Xu <herbert@gondor.apana.org.au>

[UDP]: Reread uh pointer after pskb_trim

The header may have moved when trimming.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
net/ipv4/udp.c | 1 +
1 file changed, 1 insertion(+)

--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1214,6 +1214,7 @@ int __udp4_lib_rcv(struct sk_buff *skb,

if (ulen < sizeof(*uh) || pskb_trim_rcsum(skb, ulen))
goto short_packet;
+ uh = skb->h.uh;

udp4_csum_init(skb, uh);

--