From: Herbert Xu <herbert@gondor.apana.org.au>
Date: Wed, 1 Oct 2008 14:09:38 +0000 (-0700)
Subject: net: BUG instead of corrupting memory in pskb_expand_head
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=4edd87ad5cad8e159e0db3ce3131b3d97219c9cd;p=GitHub%2FLineageOS%2Fandroid_kernel_motorola_exynos9610.git

net: BUG instead of corrupting memory in pskb_expand_head

If the caller of pskb_expand_head specifies a negative nhead
we'll silently overwrite other people's memory.  This patch
makes it BUG instead.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
---

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 2c218a0808b4..8bd248a64879 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -738,6 +738,8 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
 #endif
 	long off;
 
+	BUG_ON(nhead < 0);
+
 	if (skb_shared(skb))
 		BUG();