aboutsummaryrefslogtreecommitdiff
path: root/net/ipv4/icmp.c
diff options
context:
space:
mode:
authorDavid S. Miller <davem@davemloft.net>2012-07-12 08:06:04 -0700
committerDavid S. Miller <davem@davemloft.net>2012-07-12 08:06:04 -0700
commitf0a70e902f483295a8b6d74ef4393bc577b703d7 (patch)
tree900ea41b4306d7bdca7e1ff6db23e36e889a6073 /net/ipv4/icmp.c
parent065f5f9749202cf91dae6f39ad7e9fe8801023b5 (diff)
ipv4: Put proper checks into icmp_socket_deliver().
All handler->err() routines expect that we've done a pskb_may_pull() test to make sure that IP header length + 8 bytes can be safely pulled. Reported-by: Hiroaki SHIMODA <shimoda.hiroaki@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4/icmp.c')
-rw-r--r--net/ipv4/icmp.c12
1 files changed, 6 insertions, 6 deletions
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index d01aeb4d492..ea3a996de95 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -640,6 +640,12 @@ static void icmp_socket_deliver(struct sk_buff *skb, u32 info)
const struct net_protocol *ipprot;
int protocol = iph->protocol;
+ /* Checkin full IP header plus 8 bytes of protocol to
+ * avoid additional coding at protocol handlers.
+ */
+ if (!pskb_may_pull(skb, iph->ihl * 4 + 8))
+ return;
+
raw_icmp_error(skb, protocol, info);
rcu_read_lock();
@@ -733,12 +739,6 @@ static void icmp_unreach(struct sk_buff *skb)
goto out;
}
- /* Checkin full IP header plus 8 bytes of protocol to
- * avoid additional coding at protocol handlers.
- */
- if (!pskb_may_pull(skb, iph->ihl * 4 + 8))
- goto out;
-
icmp_socket_deliver(skb, info);
out: