diff options
| -rw-r--r-- | net/802/psnap.c | 17 |
1 files changed, 12 insertions, 5 deletions
diff --git a/net/802/psnap.c b/net/802/psnap.c index 04ee43e7538f..31128cb92a23 100644 --- a/net/802/psnap.c +++ b/net/802/psnap.c | |||
| @@ -55,6 +55,9 @@ static int snap_rcv(struct sk_buff *skb, struct net_device *dev, | |||
| 55 | .type = __constant_htons(ETH_P_SNAP), | 55 | .type = __constant_htons(ETH_P_SNAP), |
| 56 | }; | 56 | }; |
| 57 | 57 | ||
| 58 | if (unlikely(!pskb_may_pull(skb, 5))) | ||
| 59 | goto drop; | ||
| 60 | |||
| 58 | rcu_read_lock(); | 61 | rcu_read_lock(); |
| 59 | proto = find_snap_client(skb_transport_header(skb)); | 62 | proto = find_snap_client(skb_transport_header(skb)); |
| 60 | if (proto) { | 63 | if (proto) { |
| @@ -62,14 +65,18 @@ static int snap_rcv(struct sk_buff *skb, struct net_device *dev, | |||
| 62 | skb->transport_header += 5; | 65 | skb->transport_header += 5; |
| 63 | skb_pull_rcsum(skb, 5); | 66 | skb_pull_rcsum(skb, 5); |
| 64 | rc = proto->rcvfunc(skb, dev, &snap_packet_type, orig_dev); | 67 | rc = proto->rcvfunc(skb, dev, &snap_packet_type, orig_dev); |
| 65 | } else { | ||
| 66 | skb->sk = NULL; | ||
| 67 | kfree_skb(skb); | ||
| 68 | rc = 1; | ||
| 69 | } | 68 | } |
| 70 | |||
| 71 | rcu_read_unlock(); | 69 | rcu_read_unlock(); |
| 70 | |||
| 71 | if (unlikely(!proto)) | ||
| 72 | goto drop; | ||
| 73 | |||
| 74 | out: | ||
| 72 | return rc; | 75 | return rc; |
| 76 | |||
| 77 | drop: | ||
| 78 | kfree_skb(skb); | ||
| 79 | goto out; | ||
| 73 | } | 80 | } |
| 74 | 81 | ||
| 75 | /* | 82 | /* |
