From: Herbert Xu <herbert@gondor.apana.org.au>
Date: Wed, 1 Oct 2008 14:09:38 +0000 (-0700)
Subject: net: BUG instead of corrupting memory in pskb_expand_head
X-Git-Tag: v2.6.28-rc1~717^2~159
X-Git-Url: https://git.karo-electronics.de/?a=commitdiff_plain;h=4edd87ad5cad8e159e0db3ce3131b3d97219c9cd;p=karo-tx-linux.git

net: BUG instead of corrupting memory in pskb_expand_head

If the caller of pskb_expand_head specifies a negative nhead
we'll silently overwrite other people's memory.  This patch
makes it BUG instead.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
---

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 2c218a0808b4..8bd248a64879 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -738,6 +738,8 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
 #endif
 	long off;
 
+	BUG_ON(nhead < 0);
+
 	if (skb_shared(skb))
 		BUG();