|
@@ -2084,11 +2084,7 @@ static int afiucv_hs_callback_rx(struct sock *sk, struct sk_buff *skb)
|
|
return NET_RX_SUCCESS;
|
|
return NET_RX_SUCCESS;
|
|
}
|
|
}
|
|
|
|
|
|
- /* write stuff from iucv_msg to skb cb */
|
|
|
|
- if (skb->len < sizeof(struct af_iucv_trans_hdr)) {
|
|
|
|
- kfree_skb(skb);
|
|
|
|
- return NET_RX_SUCCESS;
|
|
|
|
- }
|
|
|
|
|
|
+ /* write stuff from iucv_msg to skb cb */
|
|
skb_pull(skb, sizeof(struct af_iucv_trans_hdr));
|
|
skb_pull(skb, sizeof(struct af_iucv_trans_hdr));
|
|
skb_reset_transport_header(skb);
|
|
skb_reset_transport_header(skb);
|
|
skb_reset_network_header(skb);
|
|
skb_reset_network_header(skb);
|
|
@@ -2119,6 +2115,20 @@ static int afiucv_hs_rcv(struct sk_buff *skb, struct net_device *dev,
|
|
char nullstring[8];
|
|
char nullstring[8];
|
|
int err = 0;
|
|
int err = 0;
|
|
|
|
|
|
|
|
+ if (skb->len < (ETH_HLEN + sizeof(struct af_iucv_trans_hdr))) {
|
|
|
|
+ WARN_ONCE(1, "AF_IUCV too short skb, len=%d, min=%d",
|
|
|
|
+ (int)skb->len,
|
|
|
|
+ (int)(ETH_HLEN + sizeof(struct af_iucv_trans_hdr)));
|
|
|
|
+ kfree_skb(skb);
|
|
|
|
+ return NET_RX_SUCCESS;
|
|
|
|
+ }
|
|
|
|
+ if (skb_headlen(skb) < (ETH_HLEN + sizeof(struct af_iucv_trans_hdr)))
|
|
|
|
+ if (skb_linearize(skb)) {
|
|
|
|
+ WARN_ONCE(1, "AF_IUCV skb_linearize failed, len=%d",
|
|
|
|
+ (int)skb->len);
|
|
|
|
+ kfree_skb(skb);
|
|
|
|
+ return NET_RX_SUCCESS;
|
|
|
|
+ }
|
|
skb_pull(skb, ETH_HLEN);
|
|
skb_pull(skb, ETH_HLEN);
|
|
trans_hdr = (struct af_iucv_trans_hdr *)skb->data;
|
|
trans_hdr = (struct af_iucv_trans_hdr *)skb->data;
|
|
EBCASC(trans_hdr->destAppName, sizeof(trans_hdr->destAppName));
|
|
EBCASC(trans_hdr->destAppName, sizeof(trans_hdr->destAppName));
|