aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorWei Yongjun <yjwei@cn.fujitsu.com>2009-07-02 12:57:23 -0400
committerDavid S. Miller <davem@davemloft.net>2009-07-03 22:10:06 -0400
commitc615c9f3f3cea60279b1bb38e8ef27bd575ecd0c (patch)
tree2bf343e769106a87e3cda9801e3b8cb942d722c9
parent15da4b1612d608a47e095439b3dd1d77ffe20e0c (diff)
xfrm4: fix the ports decode of sctp protocol
The SCTP pushed the skb data above the sctp chunk header, so the check of pskb_may_pull(skb, xprth + 4 - skb->data) in _decode_session4() will never return 0 because xprth + 4 - skb->data < 0, the ports decode of sctp will always fail. Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com> Acked-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r--net/ipv4/xfrm4_policy.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 60d918c96a4f..0071ee6f441f 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -136,7 +136,8 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse)
136 case IPPROTO_TCP: 136 case IPPROTO_TCP:
137 case IPPROTO_SCTP: 137 case IPPROTO_SCTP:
138 case IPPROTO_DCCP: 138 case IPPROTO_DCCP:
139 if (pskb_may_pull(skb, xprth + 4 - skb->data)) { 139 if (xprth + 4 < skb->data ||
140 pskb_may_pull(skb, xprth + 4 - skb->data)) {
140 __be16 *ports = (__be16 *)xprth; 141 __be16 *ports = (__be16 *)xprth;
141 142
142 fl->fl_ip_sport = ports[!!reverse]; 143 fl->fl_ip_sport = ports[!!reverse];