From d8443cd7cb592b302d993cb4c6b55dec6b94d790 Mon Sep 17 00:00:00 2001 From: Russell King Date: Wed, 18 Jun 2014 18:45:42 +0100 Subject: net: fec: verify checksum offset Verify that the checksum offset is inside the packet header before we zero the entry. This ensures that we don't perform an out of bounds write. Signed-off-by: Russell King --- drivers/net/ethernet/freescale/fec_main.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c index 4e164e6ab945..1ab6388abc20 100644 --- a/drivers/net/ethernet/freescale/fec_main.c +++ b/drivers/net/ethernet/freescale/fec_main.c @@ -350,10 +350,19 @@ static inline bool is_ipv4_pkt(struct sk_buff *skb) static int fec_enet_clear_csum(struct sk_buff *skb, struct net_device *ndev) { + int csum_start; + /* Only run for packets requiring a checksum. */ if (skb->ip_summed != CHECKSUM_PARTIAL) return 0; + csum_start = skb_checksum_start_offset(skb); + if (csum_start + skb->csum_offset > skb_headlen(skb)) { + netdev_err(ndev, "checksum outside skb head: headlen %u start %u offset %u\n", + skb_headlen(skb), csum_start, skb->csum_offset); + return -1; + } + if (unlikely(skb_cow_head(skb, 0))) return -1; -- cgit