summaryrefslogtreecommitdiff
path: root/net/ipv4/udp.c
diff options
context:
space:
mode:
authorLinus Torvalds <torvalds@woody.osdl.org>2006-11-26 09:42:40 -0800
committerLinus Torvalds <torvalds@woody.osdl.org>2006-11-26 09:42:40 -0800
commit137b529e4df7b9cd6b235654a3f1a8f280e3463d (patch)
tree30a84ff048ac3e42a767ffa9c6da2b81358baf7a /net/ipv4/udp.c
parent221a09d5c4cb8384d9be74db60f37a5752675255 (diff)
parent9abbffee861c6c56fce27e4eda96a10cf0de0f84 (diff)
Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6
* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6: [XFRM] STATE: Fix to respond error to get operation if no matching entry exists. [NET]: Re-fix of doc-comment in sock.h [6PACK]: Masking bug in 6pack driver. [NET]: Fix kfifo_alloc() error check. [UDP]: Make udp_encap_rcv use pskb_may_pull [NETFILTER]: H.323 conntrack: fix crash with CONFIG_IP_NF_CT_ACCT
Diffstat (limited to 'net/ipv4/udp.c')
-rw-r--r--net/ipv4/udp.c19
1 files changed, 14 insertions, 5 deletions
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 865d75214a9a..9e1bd374875e 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -928,23 +928,32 @@ static int udp_encap_rcv(struct sock * sk, struct sk_buff *skb)
return 1;
#else
struct udp_sock *up = udp_sk(sk);
- struct udphdr *uh = skb->h.uh;
+ struct udphdr *uh;
struct iphdr *iph;
int iphlen, len;
- __u8 *udpdata = (__u8 *)uh + sizeof(struct udphdr);
- __be32 *udpdata32 = (__be32 *)udpdata;
+ __u8 *udpdata;
+ __be32 *udpdata32;
__u16 encap_type = up->encap_type;
/* if we're overly short, let UDP handle it */
- if (udpdata > skb->tail)
+ len = skb->len - sizeof(struct udphdr);
+ if (len <= 0)
return 1;
/* if this is not encapsulated socket, then just return now */
if (!encap_type)
return 1;
- len = skb->tail - udpdata;
+ /* If this is a paged skb, make sure we pull up
+ * whatever data we need to look at. */
+ if (!pskb_may_pull(skb, sizeof(struct udphdr) + min(len, 8)))
+ return 1;
+
+ /* Now we can get the pointers */
+ uh = skb->h.uh;
+ udpdata = (__u8 *)uh + sizeof(struct udphdr);
+ udpdata32 = (__be32 *)udpdata;
switch (encap_type) {
default: