Commit 12dc96d1 authored by Changli Gao's avatar Changli Gao Committed by David S. Miller
Browse files

cls_rsvp: add sanity check for the packet length 



The packet length should be checked before the packet data is dereferenced.

Signed-off-by: default avatarChangli Gao <xiaosuo@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 4b95c3d4

net/sched/cls_rsvp.h

+10 −2
Original line number Diff line number Diff line
@@ -143,9 +143,17 @@ static int rsvp_classify(struct sk_buff *skb, struct tcf_proto *tp, 
	u8 tunnelid = 0;

	u8 *xprt;

#if RSVP_DST_LEN == 4

	struct ipv6hdr *nhptr = ipv6_hdr(skb);

	struct ipv6hdr *nhptr;



	if (!pskb_network_may_pull(skb, sizeof(*nhptr)))

		return -1;

	nhptr = ipv6_hdr(skb);

#else

	struct iphdr *nhptr = ip_hdr(skb);

	struct iphdr *nhptr;



	if (!pskb_network_may_pull(skb, sizeof(*nhptr)))

		return -1;

	nhptr = ip_hdr(skb);

#endif



restart: