[Patch net] gre: verify packet before using inner header

[Cong Wang <amwang@redhat.com>]

From: Cong Wang <amwang@redhat.com>

We use ->h_proto of the inner mac header before calling
pskb_may_pull() to verify the length of the packet.
This might not be a problem, but at least we'd better
error out as early as possible.

Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Pravin B Shelar <pshelar@nicira.com>
Cc: David S. Miller <davem@davemloft.net>
Signed-off-by: Cong Wang <amwang@redhat.com>

---
diff --git a/net/ipv4/gre.c b/net/ipv4/gre.c
index cc22363..8a90c67 100644
--- a/net/ipv4/gre.c
+++ b/net/ipv4/gre.c
@@ -149,6 +149,9 @@ static struct sk_buff *gre_gso_segment(struct sk_buff *skb,
 	} else
 		csum = false;
 
+	if (unlikely(!pskb_may_pull(skb, ghl)))
+		goto out;
+
 	/* setup inner skb. */
 	if (greh->protocol == htons(ETH_P_TEB)) {
 		struct ethhdr *eth = (struct ethhdr *)skb_inner_mac_header(skb);
@@ -158,9 +161,6 @@ static struct sk_buff *gre_gso_segment(struct sk_buff *skb,
 	}
 
 	skb->encapsulation = 0;
-
-	if (unlikely(!pskb_may_pull(skb, ghl)))
-		goto out;
 	__skb_pull(skb, ghl);
 	skb_reset_mac_header(skb);
 	skb_set_network_header(skb, skb_inner_network_offset(skb));