diff options
| author | Herbert Xu <herbert@gondor.apana.org.au> | 2008-10-01 16:09:38 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2008-10-01 16:09:38 +0200 |
| commit | 4edd87ad5cad8e159e0db3ce3131b3d97219c9cd (patch) | |
| tree | 6e5fc3c1e9de04a82bd536d9d8c2319f3e278501 /net/core | |
| parent | ipsec: Put dumpers on the dump list (diff) | |
| download | linux-4edd87ad5cad8e159e0db3ce3131b3d97219c9cd.tar.xz linux-4edd87ad5cad8e159e0db3ce3131b3d97219c9cd.zip | |
net: BUG instead of corrupting memory in pskb_expand_head
If the caller of pskb_expand_head specifies a negative nhead
we'll silently overwrite other people's memory. This patch
makes it BUG instead.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/core')
| -rw-r--r-- | net/core/skbuff.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 2c218a0808b4..8bd248a64879 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -738,6 +738,8 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail, #endif long off; + BUG_ON(nhead < 0); + if (skb_shared(skb)) BUG(); |