From f0a70e902f483295a8b6d74ef4393bc577b703d7 Mon Sep 17 00:00:00 2001 From: "David S. Miller" Date: Thu, 12 Jul 2012 08:06:04 -0700 Subject: ipv4: Put proper checks into icmp_socket_deliver(). All handler->err() routines expect that we've done a pskb_may_pull() test to make sure that IP header length + 8 bytes can be safely pulled. Reported-by: Hiroaki SHIMODA Signed-off-by: David S. Miller diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c index d01aeb4..ea3a996 100644 --- a/net/ipv4/icmp.c +++ b/net/ipv4/icmp.c @@ -640,6 +640,12 @@ static void icmp_socket_deliver(struct sk_buff *skb, u32 info) const struct net_protocol *ipprot; int protocol = iph->protocol; + /* Checkin full IP header plus 8 bytes of protocol to + * avoid additional coding at protocol handlers. + */ + if (!pskb_may_pull(skb, iph->ihl * 4 + 8)) + return; + raw_icmp_error(skb, protocol, info); rcu_read_lock(); @@ -733,12 +739,6 @@ static void icmp_unreach(struct sk_buff *skb) goto out; } - /* Checkin full IP header plus 8 bytes of protocol to - * avoid additional coding at protocol handlers. - */ - if (!pskb_may_pull(skb, iph->ihl * 4 + 8)) - goto out; - icmp_socket_deliver(skb, info); out: -- cgit v0.10.2