← Back to branch summary

~ubuntu-branches/ubuntu/wily/linux-ti-omap4/wily

« back to all changes in this revision

Viewing changes to net/ipv4/ip_fragment.c

  • Committer: Package Import Robot
  • Author(s): Paolo Pisati, Paolo Pisati, Ubuntu: 3.5.0-25.38
  • Date: 2013-02-20 22:03:31 UTC
  • mfrom: (74.1.1 quantal-proposed)
  • Revision ID: package-import@ubuntu.com-20130220220331-0ea4l33x3cr61nch
Tags: 3.5.0-220.28
https://launchpad.net/bugs/1130311
https://launchpad.net/bugs/1129472
https://launchpad.net/bugs/1119885
https://launchpad.net/bugs/1129192
https://launchpad.net/bugs/1119885
https://launchpad.net/bugs/1129192
https://launchpad.net/bugs/1119885
https://launchpad.net/bugs/1129192
* Release Tracking Bug
  - LP: #1130311

[ Paolo Pisati ]

* rebased on Ubuntu-3.5.0-25.38

[ Ubuntu: 3.5.0-25.38 ]

* Release Tracking Bug
  - LP: #1129472
* ptrace: introduce signal_wake_up_state() and ptrace_signal_wake_up()
  - LP: #1119885, #1129192
  - CVE-2013-0871
* ptrace: ensure arch_ptrace/ptrace_request can never race with SIGKILL
  - LP: #1119885, #1129192
  - CVE-2013-0871
* wake_up_process() should be never used to wakeup a TASK_STOPPED/TRACED
  task
  - LP: #1119885, #1129192
  - CVE-2013-0871

Show diffs side-by-side

added added

removed removed

Lines of Context:
net/ipv4/ip_fragment.c
698
698
 
699
699
struct sk_buff *ip_check_defrag(struct sk_buff *skb, u32 user)
700
700
{
701
 
        const struct iphdr *iph;
 
701
        struct iphdr iph;
702
702
        u32 len;
703
703
 
704
704
        if (skb->protocol != htons(ETH_P_IP))
705
705
                return skb;
706
706
 
707
 
        if (!pskb_may_pull(skb, sizeof(struct iphdr)))
708
 
                return skb;
709
 
 
710
 
        iph = ip_hdr(skb);
711
 
        if (iph->ihl < 5 || iph->version != 4)
712
 
                return skb;
713
 
        if (!pskb_may_pull(skb, iph->ihl*4))
714
 
                return skb;
715
 
        iph = ip_hdr(skb);
716
 
        len = ntohs(iph->tot_len);
717
 
        if (skb->len < len || len < (iph->ihl * 4))
718
 
                return skb;
719
 
 
720
 
        if (ip_is_fragment(ip_hdr(skb))) {
 
707
        if (!skb_copy_bits(skb, 0, &iph, sizeof(iph)))
 
708
                return skb;
 
709
 
 
710
        if (iph.ihl < 5 || iph.version != 4)
 
711
                return skb;
 
712
 
 
713
        len = ntohs(iph.tot_len);
 
714
        if (skb->len < len || len < (iph.ihl * 4))
 
715
                return skb;
 
716
 
 
717
        if (ip_is_fragment(&iph)) {
721
718
                skb = skb_share_check(skb, GFP_ATOMIC);
722
719
                if (skb) {
 
720
                        if (!pskb_may_pull(skb, iph.ihl*4))
 
721
                                return skb;
723
722
                        if (pskb_trim_rcsum(skb, len))
724
723
                                return skb;
725
724
                        memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));