aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--net/core/filter.c6
1 files changed, 3 insertions, 3 deletions
diff --git a/net/core/filter.c b/net/core/filter.c
index e193e29d4671..e8a6ac411ffb 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -88,7 +88,7 @@ enum {
88}; 88};
89 89
90/* No hurry in this branch */ 90/* No hurry in this branch */
91static void *__load_pointer(const struct sk_buff *skb, int k) 91static void *__load_pointer(const struct sk_buff *skb, int k, unsigned int size)
92{ 92{
93 u8 *ptr = NULL; 93 u8 *ptr = NULL;
94 94
@@ -97,7 +97,7 @@ static void *__load_pointer(const struct sk_buff *skb, int k)
97 else if (k >= SKF_LL_OFF) 97 else if (k >= SKF_LL_OFF)
98 ptr = skb_mac_header(skb) + k - SKF_LL_OFF; 98 ptr = skb_mac_header(skb) + k - SKF_LL_OFF;
99 99
100 if (ptr >= skb->head && ptr < skb_tail_pointer(skb)) 100 if (ptr >= skb->head && ptr + size <= skb_tail_pointer(skb))
101 return ptr; 101 return ptr;
102 return NULL; 102 return NULL;
103} 103}
@@ -110,7 +110,7 @@ static inline void *load_pointer(const struct sk_buff *skb, int k,
110 else { 110 else {
111 if (k >= SKF_AD_OFF) 111 if (k >= SKF_AD_OFF)
112 return NULL; 112 return NULL;
113 return __load_pointer(skb, k); 113 return __load_pointer(skb, k, size);
114 } 114 }
115} 115}
116 116