1 files changed, 4 insertions, 0 deletions

diff --git a/net/nsh/nsh.c b/net/nsh/nsh.c
index d7da99a0b0b8..9696ef96b719 100644
--- a/net/nsh/nsh.c
+++ b/net/nsh/nsh.c
@@ -57,6 +57,8 @@ int nsh_pop(struct sk_buff *skb)
                 return -ENOMEM;
         nh = (struct nshhdr *)(skb->data);
         length = nsh_hdr_len(nh);
+        if (length < NSH_BASE_HDR_LEN)
+                return -EINVAL;
         inner_proto = tun_p_to_eth_p(nh->np);
         if (!pskb_may_pull(skb, length))
                 return -ENOMEM;
@@ -90,6 +92,8 @@ static struct sk_buff *nsh_gso_segment(struct sk_buff *skb,
         if (unlikely(!pskb_may_pull(skb, NSH_BASE_HDR_LEN)))
                 goto out;
         nsh_len = nsh_hdr_len(nsh_hdr(skb));
+        if (nsh_len < NSH_BASE_HDR_LEN)
+                goto out;
         if (unlikely(!pskb_may_pull(skb, nsh_len)))
                 goto out;