[ESP]: Ensure IV is in linear part of the skb to avoid BUG() due to OOB access

[mv-sheeva.git] / net / ipv6 / esp6.c

diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 0ec1402320ea63898bd9761b6bb243cab14dad12..c6bb4c6d24b38352b4430e7892b59068714a9b3e 100644 (file)
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -282,7 +282,7 @@ static int esp6_input(struct xfrm_state *x, struct sk_buff *skb)
        struct scatterlist *sg;
        struct scatterlist *asg;
 
-       if (!pskb_may_pull(skb, sizeof(*esph))) {
+       if (!pskb_may_pull(skb, sizeof(*esph) + crypto_aead_ivsize(aead))) {
                ret = -EINVAL;
                goto out;
        }