Re: [PATCH] xfrm6: Fix ICMPv6 and MH header checks in _decode_session6

2015-09-14 Thread Steffen Klassert
On Fri, Sep 11, 2015 at 09:57:20AM +0200, Mathias Krause wrote: > From: Mathias Krause > > Ensure there's enough data left prior calling pskb_may_pull(). If > skb->data was already advanced, we'll call pskb_may_pull() with a > negative value converted to unsigned int -- leading to a huge > positi

[PATCH] xfrm6: Fix ICMPv6 and MH header checks in _decode_session6

2015-09-11 Thread Mathias Krause
From: Mathias Krause Ensure there's enough data left prior calling pskb_may_pull(). If skb->data was already advanced, we'll call pskb_may_pull() with a negative value converted to unsigned int -- leading to a huge positive value. That won't matter in practice as pskb_may_pull() will likely fail