On 04/19/2018 02:44 PM, Alexander Aring wrote: > This patch checks if sk buffer is available to dererence ife header. If > not then NULL will returned to signal an malformed ife packet. This > avoids to crashing the kernel from outside. > > Signed-off-by: Alexander Aring <ar...@mojatatu.com> > Reviewed-by: Yotam Gigi <yotam...@gmail.com> > Acked-by: Jamal Hadi Salim <j...@mojatatu.com> > --- > net/ife/ife.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/net/ife/ife.c b/net/ife/ife.c > index 7fbe70a0af4b..93e8c36ce6ec 100644 > --- a/net/ife/ife.c > +++ b/net/ife/ife.c > @@ -70,6 +70,9 @@ void *ife_decode(struct sk_buff *skb, u16 *metalen) > u16 ifehdrln; > > ifehdr = (struct ifeheadr *) (skb->data + skb->dev->hard_header_len); > + if (skb->len < skb->dev->hard_header_len + IFE_METAHDRLEN) > + return NULL; > + > ifehdrln = ntohs(ifehdr->metalen); > total_pull = skb->dev->hard_header_len + ifehdrln; > >
Nope, please use pskb_may_pull()
