llc: Fix length check in llc_fixup_skb().
authorDavid S. Miller <davem@davemloft.net>
Tue, 12 Apr 2011 01:59:05 +0000 (18:59 -0700)
committerDavid S. Miller <davem@davemloft.net>
Tue, 12 Apr 2011 01:59:05 +0000 (18:59 -0700)
Fixes bugzilla #32872

The LLC stack pretends to support non-linear skbs but there is a
direct use of skb_tail_pointer() in llc_fixup_skb().

Use pskb_may_pull() to see if data_size bytes remain and can be
accessed linearly in the packet, instead of direct pointer checks.

Signed-off-by: David S. Miller <davem@davemloft.net>
net/llc/llc_input.c

index 058f1e9a91281859bf39501619da6eb5ece8d16a..903242111317f14438bc84881358875729e21948 100644 (file)
@@ -121,8 +121,7 @@ static inline int llc_fixup_skb(struct sk_buff *skb)
                s32 data_size = ntohs(pdulen) - llc_len;
 
                if (data_size < 0 ||
-                   ((skb_tail_pointer(skb) -
-                     (u8 *)pdu) - llc_len) < data_size)
+                   !pskb_may_pull(skb, data_size))
                        return 0;
                if (unlikely(pskb_trim_rcsum(skb, data_size)))
                        return 0;