llc: Fix length check in llc_fixup_skb().
Fixes bugzilla #32872 The LLC stack pretends to support non-linear skbs but there is a direct use of skb_tail_pointer() in llc_fixup_skb(). Use pskb_may_pull() to see if data_size bytes remain and can be accessed linearly in the packet, instead of direct pointer checks. Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
4a9f65f630
commit
aa8673599f
1 changed files with 1 additions and 2 deletions
|
@ -121,8 +121,7 @@ static inline int llc_fixup_skb(struct sk_buff *skb)
|
|||
s32 data_size = ntohs(pdulen) - llc_len;
|
||||
|
||||
if (data_size < 0 ||
|
||||
((skb_tail_pointer(skb) -
|
||||
(u8 *)pdu) - llc_len) < data_size)
|
||||
!pskb_may_pull(skb, data_size))
|
||||
return 0;
|
||||
if (unlikely(pskb_trim_rcsum(skb, data_size)))
|
||||
return 0;
|
||||
|
|
Loading…
Reference in a new issue