From mboxrd@z Thu Jan 1 00:00:00 1970 From: Changli Gao Subject: [PATCH] cls_rsvp: add sanity check for the packet length Date: Wed, 4 Aug 2010 16:55:24 +0800 Message-ID: <1280912124-30374-1-git-send-email-xiaosuo@gmail.com> Cc: "David S. Miller" , netdev@vger.kernel.org, Changli Gao To: Jamal Hadi Salim Return-path: Received: from mail-pv0-f174.google.com ([74.125.83.174]:56410 "EHLO mail-pv0-f174.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754207Ab0HDIzr (ORCPT ); Wed, 4 Aug 2010 04:55:47 -0400 Received: by pvc7 with SMTP id 7so1907241pvc.19 for ; Wed, 04 Aug 2010 01:55:47 -0700 (PDT) Sender: netdev-owner@vger.kernel.org List-ID: The packet length should be checked before the packet data is dereferenced. Signed-off-by: Changli Gao --- net/sched/cls_rsvp.h | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/net/sched/cls_rsvp.h b/net/sched/cls_rsvp.h index dd9414e..4fa119d 100644 --- a/net/sched/cls_rsvp.h +++ b/net/sched/cls_rsvp.h @@ -143,9 +143,17 @@ static int rsvp_classify(struct sk_buff *skb, struct tcf_proto *tp, u8 tunnelid = 0; u8 *xprt; #if RSVP_DST_LEN == 4 - struct ipv6hdr *nhptr = ipv6_hdr(skb); + struct ipv6hdr *nhptr; + + if (!pskb_may_pull(skb, skb_network_offset(skb) + sizeof(*nhptr))) + return -1; + nhptr = ipv6_hdr(skb); #else struct iphdr *nhptr = ip_hdr(skb); + + if (!pskb_may_pull(skb, skb_network_offset(skb) + sizeof(*nhptr))) + return -1; + nhptr = ip_hdr(skb); #endif restart: