On Thu, 04 Apr 2019 22:44:33 +0200 Toke Høiland-Jørgensen <[email protected]> wrote:
> Stephen Hemminger <[email protected]> writes: > > > On Thu, 04 Apr 2019 15:01:33 +0200 > > Toke Høiland-Jørgensen <[email protected]> wrote: > > > >> static u8 cake_handle_diffserv(struct sk_buff *skb, u16 wash) > >> { > >> + int wlen = skb_network_offset(skb); > > > > In theory this could be negative, you should handle that? > > Rather than calling may_pull() with a huge unsigned value. > > Huh, that would imply that skb->network_header points to before > skb->head; when does that happen? > > Also, pskb_may_pull() does check for len > skb->len, so I guess a > follow-up question would be, "does it happen often enough to warrant > handling at this level"? > > Also, I copied that bit from sch_dsmark, so if you really thing it needs > to be fixed, I guess we should fix both... > > -Toke It should never happen just paranoid _______________________________________________ Cake mailing list [email protected] https://lists.bufferbloat.net/listinfo/cake
