diff options
| author | Russell King <rmk+kernel@arm.linux.org.uk> | 2014-06-18 18:45:42 +0100 |
|---|---|---|
| committer | Russell King <rmk+kernel@arm.linux.org.uk> | 2014-10-17 14:34:55 +0100 |
| commit | d8443cd7cb592b302d993cb4c6b55dec6b94d790 (patch) | |
| tree | 6b94260a8ca007b9e297dbc4e8d67b234d4b4068 | |
| parent | 9f2bfe818ec71806d5a0defd2a5c9bacce7998cb (diff) | |
net: fec: verify checksum offset
Verify that the checksum offset is inside the packet header before
we zero the entry. This ensures that we don't perform an out of
bounds write.
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
| -rw-r--r-- | drivers/net/ethernet/freescale/fec_main.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c index 4e164e6ab945..1ab6388abc20 100644 --- a/drivers/net/ethernet/freescale/fec_main.c +++ b/drivers/net/ethernet/freescale/fec_main.c @@ -350,10 +350,19 @@ static inline bool is_ipv4_pkt(struct sk_buff *skb) static int fec_enet_clear_csum(struct sk_buff *skb, struct net_device *ndev) { + int csum_start; + /* Only run for packets requiring a checksum. */ if (skb->ip_summed != CHECKSUM_PARTIAL) return 0; + csum_start = skb_checksum_start_offset(skb); + if (csum_start + skb->csum_offset > skb_headlen(skb)) { + netdev_err(ndev, "checksum outside skb head: headlen %u start %u offset %u\n", + skb_headlen(skb), csum_start, skb->csum_offset); + return -1; + } + if (unlikely(skb_cow_head(skb, 0))) return -1; |