| From foo@baz Thu Feb 27 20:11:26 PST 2014 |
| From: Antonio Quartulli <antonio@meshcoding.com> |
| Date: Thu, 30 Jan 2014 00:12:24 +0100 |
| Subject: batman-adv: properly check pskb_may_pull return value |
| |
| From: Antonio Quartulli <antonio@meshcoding.com> |
| |
| [ Upstream commit f1791425cf0bcda43ab9a9a37df1ad3ccb1f6654 ] |
| |
| pskb_may_pull() returns 1 on success and 0 in case of failure, |
| therefore checking for the return value being negative does |
| not make sense at all. |
| |
| This way if the function fails we will probably read beyond the current |
| skb data buffer. Fix this by doing the proper check. |
| |
| Signed-off-by: Antonio Quartulli <antonio@meshcoding.com> |
| Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| net/batman-adv/routing.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/net/batman-adv/routing.c |
| +++ b/net/batman-adv/routing.c |
| @@ -833,7 +833,7 @@ static int batadv_check_unicast_ttvn(str |
| int is_old_ttvn; |
| |
| /* check if there is enough data before accessing it */ |
| - if (pskb_may_pull(skb, hdr_len + ETH_HLEN) < 0) |
| + if (!pskb_may_pull(skb, hdr_len + ETH_HLEN)) |
| return 0; |
| |
| /* create a copy of the skb (in case of for re-routing) to modify it. */ |
