Commit 70c2efa5a32a7d38e66224844032160317fa7887
Committed by
David S. Miller
1 parent
c4363d6acd
Exists in
master
and in
7 other branches
act_nat: not all of the ICMP packets need an IP header payload
not all of the ICMP packets need an IP header payload, so we check the length of the skbs only when the packets should have an IP header payload. Based upon analysis and initial patch by Rodrigo Partearroyo González. Signed-off-by: Changli Gao <xiaosuo@gmail.com> Acked-by: Herbert Xu <herbert@gondor.apana.org.au> ---- net/sched/act_nat.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) Signed-off-by: David S. Miller <davem@davemloft.net>
Showing 1 changed file with 4 additions and 1 deletions Side-by-side Diff
net/sched/act_nat.c
... | ... | @@ -205,7 +205,7 @@ |
205 | 205 | { |
206 | 206 | struct icmphdr *icmph; |
207 | 207 | |
208 | - if (!pskb_may_pull(skb, ihl + sizeof(*icmph) + sizeof(*iph))) | |
208 | + if (!pskb_may_pull(skb, ihl + sizeof(*icmph))) | |
209 | 209 | goto drop; |
210 | 210 | |
211 | 211 | icmph = (void *)(skb_network_header(skb) + ihl); |
... | ... | @@ -214,6 +214,9 @@ |
214 | 214 | (icmph->type != ICMP_TIME_EXCEEDED) && |
215 | 215 | (icmph->type != ICMP_PARAMETERPROB)) |
216 | 216 | break; |
217 | + | |
218 | + if (!pskb_may_pull(skb, ihl + sizeof(*icmph) + sizeof(*iph))) | |
219 | + goto drop; | |
217 | 220 | |
218 | 221 | iph = (void *)(icmph + 1); |
219 | 222 | if (egress) |