diff options
author | Jason Gunthorpe <jgg@nvidia.com> | 2020-08-31 12:28:12 -0300 |
---|---|---|
committer | Jason Gunthorpe <jgg@nvidia.com> | 2020-08-31 12:28:12 -0300 |
commit | 6989aa62d342d79d447a9af12477b907d211bebe (patch) | |
tree | 09722ffca5dea6933dec72691f89a8cb09f78656 /net/core/skbuff.c | |
parent | RDMA/rxe: Address an issue with hardened user copy (diff) | |
parent | Linux 5.9-rc3 (diff) | |
download | linux-dev-6989aa62d342d79d447a9af12477b907d211bebe.tar.xz linux-dev-6989aa62d342d79d447a9af12477b907d211bebe.zip |
Merge tag 'v5.9-rc3' into rdma.git for-next
Required due to dependencies in following patches.
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Diffstat (limited to 'net/core/skbuff.c')
-rw-r--r-- | net/core/skbuff.c | 14 |
1 files changed, 9 insertions, 5 deletions
diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 7e2e502ef519..e18184ffa9c3 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -5418,8 +5418,8 @@ struct sk_buff *skb_vlan_untag(struct sk_buff *skb) skb = skb_share_check(skb, GFP_ATOMIC); if (unlikely(!skb)) goto err_free; - - if (unlikely(!pskb_may_pull(skb, VLAN_HLEN))) + /* We may access the two bytes after vlan_hdr in vlan_set_encap_proto(). */ + if (unlikely(!pskb_may_pull(skb, VLAN_HLEN + sizeof(unsigned short)))) goto err_free; vhdr = (struct vlan_hdr *)skb->data; @@ -5987,9 +5987,13 @@ static int pskb_carve_inside_nonlinear(struct sk_buff *skb, const u32 off, if (skb_has_frag_list(skb)) skb_clone_fraglist(skb); - if (k == 0) { - /* split line is in frag list */ - pskb_carve_frag_list(skb, shinfo, off - pos, gfp_mask); + /* split line is in frag list */ + if (k == 0 && pskb_carve_frag_list(skb, shinfo, off - pos, gfp_mask)) { + /* skb_frag_unref() is not needed here as shinfo->nr_frags = 0. */ + if (skb_has_frag_list(skb)) + kfree_skb_list(skb_shinfo(skb)->frag_list); + kfree(data); + return -ENOMEM; } skb_release_data(skb); |