Skip to content

L
linux
Commit 586a9859 authored by David S. Miller's avatar David S. Miller
Browse files
Options

[IPV4]: In arp_rcv(), inspect skb->nh.arph after pskb_may_pull() not before.

parent 525e26f7
Show whitespace changes
Inline Side-by-side
Showing with 2 additions and 1 deletion
net/ipv4/arp.c
View file @ 586a9859
...@@ -829,7 +829,7 @@ int arp_process(struct sk_buff *skb) ...@@ -829,7 +829,7 @@ int arp_process(struct sk_buff *skb)
int arp_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt) int arp_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt)
{ {
struct arphdr *arp = skb->nh.arph; struct arphdr *arp;
/* ARP header, plus 2 device addresses, plus 2 IP addresses. */ /* ARP header, plus 2 device addresses, plus 2 IP addresses. */
if (!pskb_may_pull(skb, (sizeof(struct arphdr) + if (!pskb_may_pull(skb, (sizeof(struct arphdr) +
...@@ -837,6 +837,7 @@ int arp_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt) ...@@ -837,6 +837,7 @@ int arp_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt)
(2 * sizeof(u32))))) (2 * sizeof(u32)))))
goto freeskb; goto freeskb;
arp = skb->nh.arph;
if (arp->ar_hln != dev->addr_len || if (arp->ar_hln != dev->addr_len ||
dev->flags & IFF_NOARP || dev->flags & IFF_NOARP ||
skb->pkt_type == PACKET_OTHERHOST || skb->pkt_type == PACKET_OTHERHOST ||
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7