From: Eric Dumazet <eric.duma...@gmail.com>
Date: Thu, 18 Jan 2018 19:59:19 -0800
> From: Eric Dumazet <eduma...@google.com>
>
> Without proper validation of DODGY packets, we might very well
> feed qdisc_pkt_len_init() with invalid GSO packets.
>
> tcp_hdrlen() might access out-of-bound data, so let's use
> skb_header_pointer() and proper checks.
>
> Whole story is described in commit d0c081b49137 ("flow_dissector:
> properly cap thoff field")
>
> We have the goal of validating DODGY packets earlier in the stack,
> so we might very well revert this fix in the future.
>
> Signed-off-by: Eric Dumazet <eduma...@google.com>
> Cc: Willem de Bruijn <will...@google.com>
> Cc: Jason Wang <jasow...@redhat.com>
> Reported-by: syzbot+9da69ebac7dddd804...@syzkaller.appspotmail.com
Applied and queued up for -stable, thanks Eric.
