diff options
| author | Greg Kroah-Hartman <gregkh@google.com> | 2021-01-17 14:24:13 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@google.com> | 2021-01-17 14:24:13 +0100 |
| commit | cf3e310ff85b280eec62a1470465d986be80c204 (patch) | |
| tree | 0c54b22039687e9ad214d6da7ca1506bcc30b888 /net/core/skbuff.c | |
| parent | d29d26d11fc2c6457fc0d7b45b67d01a81575cea (diff) | |
| parent | 4328b0f47a72b408ff9038a79817b3698281914f (diff) | |
Merge 4.4.252 into android-4.4-p
Changes in 4.4.252
target: add XCOPY target/segment desc sense codes
target: bounds check XCOPY segment descriptor list
target: simplify XCOPY wwn->se_dev lookup helper
target: use XCOPY segment descriptor CSCD IDs
xcopy: loop over devices using idr helper
scsi: target: Fix XCOPY NAA identifier lookup
powerpc: Fix incorrect stw{, ux, u, x} instructions in __set_pte_at
net: ip: always refragment ip defragmented packets
net: fix pmtu check in nopmtudisc mode
vmlinux.lds.h: Add PGO and AutoFDO input sections
ubifs: wbuf: Don't leak kernel memory to flash
spi: pxa2xx: Fix use-after-free on unbind
cpufreq: powernow-k8: pass policy rather than use cpufreq_cpu_get()
wil6210: select CONFIG_CRC32
block: rsxx: select CONFIG_CRC32
iommu/intel: Fix memleak in intel_irq_remapping_alloc
block: fix use-after-free in disk_part_iter_next
net: drop bogus skb with CHECKSUM_PARTIAL and offset beyond end of trimmed packet
Linux 4.4.252
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I52de3890001cf1dd465a82774f65934443485761
Diffstat (limited to 'net/core/skbuff.c')
| -rw-r--r-- | net/core/skbuff.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/net/core/skbuff.c b/net/core/skbuff.c index e87ec3659ef6..f77ea52be8bf 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -1516,6 +1516,12 @@ int pskb_trim_rcsum_slow(struct sk_buff *skb, unsigned int len) skb->csum = csum_block_sub(skb->csum, skb_checksum(skb, len, delta, 0), len); + } else if (skb->ip_summed == CHECKSUM_PARTIAL) { + int hdlen = (len > skb_headlen(skb)) ? skb_headlen(skb) : len; + int offset = skb_checksum_start_offset(skb) + skb->csum_offset; + + if (offset + sizeof(__sum16) > hdlen) + return -EINVAL; } return __pskb_trim(skb, len); } |