diff options
Diffstat (limited to 'net/ipv4/udp.c')
-rw-r--r-- | net/ipv4/udp.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c index b7faffe5c029..cc3a0a06c004 100644 --- a/net/ipv4/udp.c +++ b/net/ipv4/udp.c | |||
@@ -1015,9 +1015,11 @@ static int __udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) | |||
1015 | 1015 | ||
1016 | if ((rc = sock_queue_rcv_skb(sk, skb)) < 0) { | 1016 | if ((rc = sock_queue_rcv_skb(sk, skb)) < 0) { |
1017 | /* Note that an ENOMEM error is charged twice */ | 1017 | /* Note that an ENOMEM error is charged twice */ |
1018 | if (rc == -ENOMEM) | 1018 | if (rc == -ENOMEM) { |
1019 | UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS, | 1019 | UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS, |
1020 | is_udplite); | 1020 | is_udplite); |
1021 | atomic_inc(&sk->sk_drops); | ||
1022 | } | ||
1021 | goto drop; | 1023 | goto drop; |
1022 | } | 1024 | } |
1023 | 1025 | ||
@@ -1229,7 +1231,7 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, | |||
1229 | int proto) | 1231 | int proto) |
1230 | { | 1232 | { |
1231 | struct sock *sk; | 1233 | struct sock *sk; |
1232 | struct udphdr *uh = udp_hdr(skb); | 1234 | struct udphdr *uh; |
1233 | unsigned short ulen; | 1235 | unsigned short ulen; |
1234 | struct rtable *rt = (struct rtable*)skb->dst; | 1236 | struct rtable *rt = (struct rtable*)skb->dst; |
1235 | __be32 saddr = ip_hdr(skb)->saddr; | 1237 | __be32 saddr = ip_hdr(skb)->saddr; |
@@ -1242,6 +1244,7 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, | |||
1242 | if (!pskb_may_pull(skb, sizeof(struct udphdr))) | 1244 | if (!pskb_may_pull(skb, sizeof(struct udphdr))) |
1243 | goto drop; /* No space for header. */ | 1245 | goto drop; /* No space for header. */ |
1244 | 1246 | ||
1247 | uh = udp_hdr(skb); | ||
1245 | ulen = ntohs(uh->len); | 1248 | ulen = ntohs(uh->len); |
1246 | if (ulen > skb->len) | 1249 | if (ulen > skb->len) |
1247 | goto short_packet; | 1250 | goto short_packet; |