path: root/net/openvswitch
diff options
authorJesse Gross <jesse@nicira.com>2012-04-02 14:26:27 -0700
committerJesse Gross <jesse@nicira.com>2012-04-02 14:28:57 -0700
commitbf32fecdc1851ad9ca960f56771b798d17c26cf1 (patch)
tree039b57775613b56c84d2651071cfb7cc8cd536cf /net/openvswitch
parentdd775ae2549217d3ae09363e3edb305d0fa19928 (diff)
openvswitch: Add length check when retrieving TCP flags.
When collecting TCP flags we check that the IP header indicates that a TCP header is present but not that the packet is actually long enough to contain the header. This adds a check to prevent reading off the end of the packet. In practice, this is only likely to result in reading of bad data and not a crash due to the presence of struct skb_shared_info at the end of the packet. Signed-off-by: Jesse Gross <jesse@nicira.com>
Diffstat (limited to 'net/openvswitch')
1 files changed, 2 insertions, 1 deletions
diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
index 1252c3081ef..2a11ec2383e 100644
--- a/net/openvswitch/flow.c
+++ b/net/openvswitch/flow.c
@@ -183,7 +183,8 @@ void ovs_flow_used(struct sw_flow *flow, struct sk_buff *skb)
u8 tcp_flags = 0;
if (flow->key.eth.type == htons(ETH_P_IP) &&
- flow->key.ip.proto == IPPROTO_TCP) {
+ flow->key.ip.proto == IPPROTO_TCP &&
+ likely(skb->len >= skb_transport_offset(skb) + sizeof(struct tcphdr))) {
u8 *tcp = (u8 *)tcp_hdr(skb);
tcp_flags = *(tcp + TCP_FLAGS_OFFSET) & TCP_FLAG_MASK;