Searched hist:da521b2c (Results 1 – 1 of 1) sorted by relevance
| /openbmc/linux/include/net/ |
| H A D | pkt_cls.h | da521b2c Tue Dec 21 14:43:16 CST 2010 David S. Miller <davem@davemloft.net> net: Fix range checks in tcf_valid_offset().
This function has three bugs:
1) The offset should be valid most of the time, this is just
a sanity check, therefore we should use "likely" not "unlikely"
2) This is the only place where we can check for arithmetic overflow
of the pointer plus the length.
3) The existing range checks are off by one, the valid range is
skb->head to skb_tail_pointer(), inclusive.
Based almost entirely upon a patch by Ralph Loader.
Reported-by: Ralph Loader <suckfish@ihug.co.nz>
Signed-off-by: David S. Miller <davem@davemloft.net>
da521b2c Tue Dec 21 14:43:16 CST 2010 David S. Miller <davem@davemloft.net> net: Fix range checks in tcf_valid_offset().
This function has three bugs:
1) The offset should be valid most of the time, this is just
a sanity check, therefore we should use "likely" not "unlikely"
2) This is the only place where we can check for arithmetic overflow
of the pointer plus the length.
3) The existing range checks are off by one, the valid range is
skb->head to skb_tail_pointer(), inclusive.
Based almost entirely upon a patch by Ralph Loader.
Reported-by: Ralph Loader <suckfish@ihug.co.nz>
Signed-off-by: David S. Miller <davem@davemloft.net>
|