summaryrefslogtreecommitdiff
path: root/net/core
diff options
context:
space:
mode:
authorHerbert Xu <herbert@gondor.apana.org.au>2008-10-01 07:09:38 -0700
committerDavid S. Miller <davem@davemloft.net>2008-10-01 07:09:38 -0700
commit4edd87ad5cad8e159e0db3ce3131b3d97219c9cd (patch)
tree6e5fc3c1e9de04a82bd536d9d8c2319f3e278501 /net/core
parent12a169e7d8f4b1c95252d8b04ed0f1033ed7cfe2 (diff)
net: BUG instead of corrupting memory in pskb_expand_head
If the caller of pskb_expand_head specifies a negative nhead we'll silently overwrite other people's memory. This patch makes it BUG instead. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/core')
-rw-r--r--net/core/skbuff.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 2c218a0808b4..8bd248a64879 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -738,6 +738,8 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
#endif
long off;
+ BUG_ON(nhead < 0);
+
if (skb_shared(skb))
BUG();