diff options
author | Haavard Skinnemoen <haavard.skinnemoen@atmel.com> | 2009-12-14 19:23:03 +0100 |
---|---|---|
committer | Haavard Skinnemoen <haavard.skinnemoen@atmel.com> | 2009-12-14 19:23:03 +0100 |
commit | 559300bc0ef7ccd541656f1189d38e7088389559 (patch) | |
tree | cd1682881ca4246e9c5a1e8632be4bdd9d9706c6 /net/ipv4/raw.c | |
parent | 5416bf33f92a4104dbcd6062bf377c8421ca3cfd (diff) | |
parent | 22763c5cf3690a681551162c15d34d935308c8d7 (diff) | |
download | op-kernel-dev-559300bc0ef7ccd541656f1189d38e7088389559.zip op-kernel-dev-559300bc0ef7ccd541656f1189d38e7088389559.tar.gz |
Merge commit 'v2.6.32'
Conflicts:
arch/avr32/mach-at32ap/include/mach/cpu.h
Diffstat (limited to 'net/ipv4/raw.c')
-rw-r--r-- | net/ipv4/raw.c | 24 |
1 files changed, 17 insertions, 7 deletions
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c index 757c917..ab996f9 100644 --- a/net/ipv4/raw.c +++ b/net/ipv4/raw.c @@ -352,13 +352,24 @@ static int raw_send_hdrinc(struct sock *sk, void *from, size_t length, skb->ip_summed = CHECKSUM_NONE; skb->transport_header = skb->network_header; - err = memcpy_fromiovecend((void *)iph, from, 0, length); - if (err) - goto error_fault; + err = -EFAULT; + if (memcpy_fromiovecend((void *)iph, from, 0, length)) + goto error_free; - /* We don't modify invalid header */ iphlen = iph->ihl * 4; - if (iphlen >= sizeof(*iph) && iphlen <= length) { + + /* + * We don't want to modify the ip header, but we do need to + * be sure that it won't cause problems later along the network + * stack. Specifically we want to make sure that iph->ihl is a + * sane value. If ihl points beyond the length of the buffer passed + * in, reject the frame as invalid + */ + err = -EINVAL; + if (iphlen > length) + goto error_free; + + if (iphlen >= sizeof(*iph)) { if (!iph->saddr) iph->saddr = rt->rt_src; iph->check = 0; @@ -381,8 +392,7 @@ static int raw_send_hdrinc(struct sock *sk, void *from, size_t length, out: return 0; -error_fault: - err = -EFAULT; +error_free: kfree_skb(skb); error: IP_INC_STATS(net, IPSTATS_MIB_OUTDISCARDS); |