ipv6: l2tp: fix a potential issue in l2tp_ip6_recv
[ Upstream commit be447f3054
]
pskb_may_pull() can change skb->data, so we have to load ptr/optr at the
right place.
Signed-off-by: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
wifi-calibration
parent
a9c5107769
commit
1d8ad31a7e
|
@ -135,12 +135,11 @@ static int l2tp_ip6_recv(struct sk_buff *skb)
|
|||
struct l2tp_tunnel *tunnel = NULL;
|
||||
int length;
|
||||
|
||||
/* Point to L2TP header */
|
||||
optr = ptr = skb->data;
|
||||
|
||||
if (!pskb_may_pull(skb, 4))
|
||||
goto discard;
|
||||
|
||||
/* Point to L2TP header */
|
||||
optr = ptr = skb->data;
|
||||
session_id = ntohl(*((__be32 *) ptr));
|
||||
ptr += 4;
|
||||
|
||||
|
@ -168,6 +167,9 @@ static int l2tp_ip6_recv(struct sk_buff *skb)
|
|||
if (!pskb_may_pull(skb, length))
|
||||
goto discard;
|
||||
|
||||
/* Point to L2TP header */
|
||||
optr = ptr = skb->data;
|
||||
ptr += 4;
|
||||
pr_debug("%s: ip recv\n", tunnel->name);
|
||||
print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, ptr, length);
|
||||
}
|
||||
|
|
Loading…
Reference in New Issue