diff options
| author | Thomas Gleixner <tglx@linutronix.de> | 2018-05-19 13:55:40 +0200 |
|---|---|---|
| committer | Thomas Gleixner <tglx@linutronix.de> | 2018-05-19 13:55:40 +0200 |
| commit | b563ea676a46f3a297b1e64b6ece25b934aafba5 (patch) | |
| tree | 7b18cca93a853b253375d0a3f1cb5af242771768 /net/nsh/nsh.c | |
| parent | 4fe581d7f114d56f31f392448477cff5a4394065 (diff) | |
| parent | 73fcb1a370c76b202d406e95d9dabb76eaccf484 (diff) | |
| download | lwn-b563ea676a46f3a297b1e64b6ece25b934aafba5.tar.gz lwn-b563ea676a46f3a297b1e64b6ece25b934aafba5.zip | |
Merge branch 'linus' into timers/2038
Merge upstream to pick up changes on which pending patches depend on.
Diffstat (limited to 'net/nsh/nsh.c')
| -rw-r--r-- | net/nsh/nsh.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/net/nsh/nsh.c b/net/nsh/nsh.c index d7da99a0b0b8..9696ef96b719 100644 --- a/net/nsh/nsh.c +++ b/net/nsh/nsh.c @@ -57,6 +57,8 @@ int nsh_pop(struct sk_buff *skb) return -ENOMEM; nh = (struct nshhdr *)(skb->data); length = nsh_hdr_len(nh); + if (length < NSH_BASE_HDR_LEN) + return -EINVAL; inner_proto = tun_p_to_eth_p(nh->np); if (!pskb_may_pull(skb, length)) return -ENOMEM; @@ -90,6 +92,8 @@ static struct sk_buff *nsh_gso_segment(struct sk_buff *skb, if (unlikely(!pskb_may_pull(skb, NSH_BASE_HDR_LEN))) goto out; nsh_len = nsh_hdr_len(nsh_hdr(skb)); + if (nsh_len < NSH_BASE_HDR_LEN) + goto out; if (unlikely(!pskb_may_pull(skb, nsh_len))) goto out; |