git.openpandora.org
/
pandora-kernel.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
Merge branch 'devel' of master.kernel.org:/home/rmk/linux-2.6-arm
[pandora-kernel.git]
/
net
/
llc
/
llc_input.c
diff --git
a/net/llc/llc_input.c
b/net/llc/llc_input.c
index
a69c5c4
..
57ad974
100644
(file)
--- a/
net/llc/llc_input.c
+++ b/
net/llc/llc_input.c
@@
-117,8
+117,12
@@
static inline int llc_fixup_skb(struct sk_buff *skb)
skb_pull(skb, llc_len);
if (skb->protocol == htons(ETH_P_802_2)) {
__be16 pdulen = eth_hdr(skb)->h_proto;
skb_pull(skb, llc_len);
if (skb->protocol == htons(ETH_P_802_2)) {
__be16 pdulen = eth_hdr(skb)->h_proto;
-
u16
data_size = ntohs(pdulen) - llc_len;
+
s32
data_size = ntohs(pdulen) - llc_len;
+ if (data_size < 0 ||
+ ((skb_tail_pointer(skb) -
+ (u8 *)pdu) - llc_len) < data_size)
+ return 0;
if (unlikely(pskb_trim_rcsum(skb, data_size)))
return 0;
}
if (unlikely(pskb_trim_rcsum(skb, data_size)))
return 0;
}
@@
-146,7
+150,7
@@
int llc_rcv(struct sk_buff *skb, struct net_device *dev,
int (*rcv)(struct sk_buff *, struct net_device *,
struct packet_type *, struct net_device *);
int (*rcv)(struct sk_buff *, struct net_device *,
struct packet_type *, struct net_device *);
- if (
dev_net(dev) != &init_net
)
+ if (
!net_eq(dev_net(dev), &init_net)
)
goto drop;
/*
goto drop;
/*