x25: Handle undersized/fragmented skbs
authorMatthew Daley <mattjd@gmail.com>
Fri, 14 Oct 2011 18:45:04 +0000 (18:45 +0000)
committerDavid S. Miller <davem@davemloft.net>
Mon, 17 Oct 2011 23:31:39 +0000 (19:31 -0400)
commitcb101ed2c3c7c0224d16953fe77bfb9d6c2cb9df
tree3d266ac18673ebc85a99e4d10d8d381ff1ebd782
parentc7fd0d48bde943e228e9c28ce971a22d6a1744c4
x25: Handle undersized/fragmented skbs

There are multiple locations in the X.25 packet layer where a skb is
assumed to be of at least a certain size and that all its data is
currently available at skb->data.  These assumptions are not checked,
hence buffer overreads may occur.  Use pskb_may_pull to check these
minimal size assumptions and ensure that data is available at skb->data
when necessary, as well as use skb_copy_bits where needed.

Signed-off-by: Matthew Daley <mattjd@gmail.com>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Andrew Hendry <andrew.hendry@gmail.com>
Cc: stable <stable@kernel.org>
Acked-by: Andrew Hendry <andrew.hendry@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/x25/af_x25.c
net/x25/x25_dev.c
net/x25/x25_facilities.c
net/x25/x25_in.c
net/x25/x25_link.c
net/x25/x25_subr.c