[ESP]: Ensure IV is in linear part of the skb to avoid BUG() due to OOB access

[mv-sheeva.git] / net / ipv4 / esp4.c

diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index f3ceca31aa45c15e361f3d8557d4a5c13f726905..4e73e5708e700d276ddb3be80a9452931621a15b 100644 (file)
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -336,7 +336,7 @@ static int esp_input(struct xfrm_state *x, struct sk_buff *skb)
        struct scatterlist *asg;
        int err = -EINVAL;
 
-       if (!pskb_may_pull(skb, sizeof(*esph)))
+       if (!pskb_may_pull(skb, sizeof(*esph) + crypto_aead_ivsize(aead)))
                goto out;
 
        if (elen <= 0)