diff options
Diffstat (limited to 'net')
-rw-r--r-- | net/core/filter.c | 8 |
1 files changed, 2 insertions, 6 deletions
diff --git a/net/core/filter.c b/net/core/filter.c index 3923428a840f..cd91a24f9720 100644 --- a/net/core/filter.c +++ b/net/core/filter.c | |||
@@ -76,10 +76,6 @@ static inline void *load_pointer(struct sk_buff *skb, int k, | |||
76 | 76 | ||
77 | int sk_run_filter(struct sk_buff *skb, struct sock_filter *filter, int flen) | 77 | int sk_run_filter(struct sk_buff *skb, struct sock_filter *filter, int flen) |
78 | { | 78 | { |
79 | /* len is UNSIGNED. Byte wide insns relies only on implicit | ||
80 | type casts to prevent reading arbitrary memory locations. | ||
81 | */ | ||
82 | unsigned int len = skb->len-skb->data_len; | ||
83 | struct sock_filter *fentry; /* We walk down these */ | 79 | struct sock_filter *fentry; /* We walk down these */ |
84 | void *ptr; | 80 | void *ptr; |
85 | u32 A = 0; /* Accumulator */ | 81 | u32 A = 0; /* Accumulator */ |
@@ -206,10 +202,10 @@ load_b: | |||
206 | } | 202 | } |
207 | return 0; | 203 | return 0; |
208 | case BPF_LD|BPF_W|BPF_LEN: | 204 | case BPF_LD|BPF_W|BPF_LEN: |
209 | A = len; | 205 | A = skb->len; |
210 | continue; | 206 | continue; |
211 | case BPF_LDX|BPF_W|BPF_LEN: | 207 | case BPF_LDX|BPF_W|BPF_LEN: |
212 | X = len; | 208 | X = skb->len; |
213 | continue; | 209 | continue; |
214 | case BPF_LD|BPF_W|BPF_IND: | 210 | case BPF_LD|BPF_W|BPF_IND: |
215 | k = X + fentry->k; | 211 | k = X + fentry->k; |