summaryrefslogtreecommitdiff
path: root/net
diff options
context:
space:
mode:
authorKumar Sanghvi <kumar.sanghvi@stericsson.com>2010-09-27 23:10:42 +0000
committerGreg Kroah-Hartman <gregkh@suse.de>2010-10-28 21:44:07 -0700
commit81f9ffe4909999ea0608b8a77e7aa289cba84bf8 (patch)
tree96697838cb1599a5082ed1b85e9fa20ae4641452 /net
parenta39fcb1368a3b3ea991baac85d6b6b032b079b7d (diff)
Phonet: Correct header retrieval after pskb_may_pull
[ Upstream commit a91e7d471e2e384035b9746ea707ccdcd353f5dd ] Retrieve the header after doing pskb_may_pull since, pskb_may_pull could change the buffer structure. This is based on the comment given by Eric Dumazet on Phonet Pipe controller patch for a similar problem. Signed-off-by: Kumar Sanghvi <kumar.sanghvi@stericsson.com> Acked-by: Linus Walleij <linus.walleij@stericsson.com> Acked-by: Eric Dumazet <eric.dumazet@gmail.com> Acked-by: RĂ©mi Denis-Courmont <remi.denis-courmont@nokia.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'net')
-rw-r--r--net/phonet/pep.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index 5f32d217535b..9cdd35e78759 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -224,12 +224,13 @@ static void pipe_grant_credits(struct sock *sk)
static int pipe_rcv_status(struct sock *sk, struct sk_buff *skb)
{
struct pep_sock *pn = pep_sk(sk);
- struct pnpipehdr *hdr = pnp_hdr(skb);
+ struct pnpipehdr *hdr;
int wake = 0;
if (!pskb_may_pull(skb, sizeof(*hdr) + 4))
return -EINVAL;
+ hdr = pnp_hdr(skb);
if (hdr->data[0] != PN_PEP_TYPE_COMMON) {
LIMIT_NETDEBUG(KERN_DEBUG"Phonet unknown PEP type: %u\n",
(unsigned)hdr->data[0]);