Commit 70c2efa5a32a7d38e66224844032160317fa7887

Authored by Changli Gao
Committed by David S. Miller
1 parent c4363d6acd

act_nat: not all of the ICMP packets need an IP header payload

not all of the ICMP packets need an IP header payload, so we check the length
of the skbs only when the packets should have an IP header payload.

Based upon analysis and initial patch by Rodrigo Partearroyo González.

Signed-off-by: Changli Gao <xiaosuo@gmail.com>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
----
 net/sched/act_nat.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)
Signed-off-by: David S. Miller <davem@davemloft.net>

Showing 1 changed file with 4 additions and 1 deletions Side-by-side Diff

... ... @@ -205,7 +205,7 @@
205 205 {
206 206 struct icmphdr *icmph;
207 207  
208   - if (!pskb_may_pull(skb, ihl + sizeof(*icmph) + sizeof(*iph)))
  208 + if (!pskb_may_pull(skb, ihl + sizeof(*icmph)))
209 209 goto drop;
210 210  
211 211 icmph = (void *)(skb_network_header(skb) + ihl);
... ... @@ -214,6 +214,9 @@
214 214 (icmph->type != ICMP_TIME_EXCEEDED) &&
215 215 (icmph->type != ICMP_PARAMETERPROB))
216 216 break;
  217 +
  218 + if (!pskb_may_pull(skb, ihl + sizeof(*icmph) + sizeof(*iph)))
  219 + goto drop;
217 220  
218 221 iph = (void *)(icmph + 1);
219 222 if (egress)