Commit 4382f5c3 authored by David S. Miller's avatar David S. Miller

[NET]: Add missing skb_share_check() calls to econet/bpqether/lapbether/ipconfig.

parent 0e8cef16
...@@ -175,6 +175,9 @@ static int bpq_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_ty ...@@ -175,6 +175,9 @@ static int bpq_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_ty
struct ethhdr *eth; struct ethhdr *eth;
struct bpqdev *bpq; struct bpqdev *bpq;
if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
return NET_RX_DROP;
if (!pskb_may_pull(skb, sizeof(struct ethhdr))) if (!pskb_may_pull(skb, sizeof(struct ethhdr)))
goto drop; goto drop;
......
...@@ -89,6 +89,9 @@ static int lapbeth_rcv(struct sk_buff *skb, struct net_device *dev, struct packe ...@@ -89,6 +89,9 @@ static int lapbeth_rcv(struct sk_buff *skb, struct net_device *dev, struct packe
int len, err; int len, err;
struct lapbethdev *lapbeth; struct lapbethdev *lapbeth;
if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
return NET_RX_DROP;
if (!pskb_may_pull(skb, 2)) if (!pskb_may_pull(skb, 2))
goto drop; goto drop;
......
...@@ -1015,16 +1015,17 @@ static int econet_rcv(struct sk_buff *skb, struct net_device *dev, struct packet ...@@ -1015,16 +1015,17 @@ static int econet_rcv(struct sk_buff *skb, struct net_device *dev, struct packet
struct sock *sk; struct sock *sk;
struct ec_device *edev = dev->ec_ptr; struct ec_device *edev = dev->ec_ptr;
if (!edev) { if (skb->pkt_type == PACKET_OTHERHOST)
kfree_skb(skb); goto drop;
return 0;
}
if (!pskb_may_pull(skb, sizeof(struct ec_framehdr))) { if (!edev)
/* Frame is too small to be any use */ goto drop;
kfree_skb(skb);
return 0; if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
} return NET_RX_DROP;
if (!pskb_may_pull(skb, sizeof(struct ec_framehdr)))
goto drop;
hdr = (struct ec_framehdr *) skb->data; hdr = (struct ec_framehdr *) skb->data;
...@@ -1037,13 +1038,15 @@ static int econet_rcv(struct sk_buff *skb, struct net_device *dev, struct packet ...@@ -1037,13 +1038,15 @@ static int econet_rcv(struct sk_buff *skb, struct net_device *dev, struct packet
} }
sk = ec_listening_socket(hdr->port, hdr->src_stn, hdr->src_net); sk = ec_listening_socket(hdr->port, hdr->src_stn, hdr->src_net);
if (!sk) { if (!sk)
kfree_skb(skb); goto drop;
return 0;
}
return ec_queue_packet(sk, skb, edev->net, hdr->src_stn, hdr->cb, return ec_queue_packet(sk, skb, edev->net, hdr->src_stn, hdr->cb,
hdr->port); hdr->port);
drop:
kfree_skb(skb);
return 0;
} }
static struct packet_type econet_packet_type = { static struct packet_type econet_packet_type = {
......
...@@ -415,6 +415,9 @@ ic_rarp_recv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt ...@@ -415,6 +415,9 @@ ic_rarp_recv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
unsigned char *sha, *tha; /* s for "source", t for "target" */ unsigned char *sha, *tha; /* s for "source", t for "target" */
struct ic_device *d; struct ic_device *d;
if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
return NET_RX_DROP;
if (!pskb_may_pull(skb, sizeof(arphdr))) if (!pskb_may_pull(skb, sizeof(arphdr)))
goto drop; goto drop;
...@@ -823,6 +826,9 @@ static int __init ic_bootp_recv(struct sk_buff *skb, struct net_device *dev, str ...@@ -823,6 +826,9 @@ static int __init ic_bootp_recv(struct sk_buff *skb, struct net_device *dev, str
if (skb->pkt_type == PACKET_OTHERHOST) if (skb->pkt_type == PACKET_OTHERHOST)
goto drop; goto drop;
if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
return NET_RX_DROP;
if (!pskb_may_pull(skb, if (!pskb_may_pull(skb,
sizeof(struct iphdr) + sizeof(struct iphdr) +
sizeof(struct udphdr))) sizeof(struct udphdr)))
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment