Commit 4edd87ad authored Oct 01, 2008 by Herbert Xu Committed by David S. Miller Oct 01, 2008

net: BUG instead of corrupting memory in pskb_expand_head



If the caller of pskb_expand_head specifies a negative nhead
we'll silently overwrite other people's memory.  This patch
makes it BUG instead.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 12a169e7

net/core/skbuff.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -738,6 +738,8 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
		#endif
		long off;

		BUG_ON(nhead < 0);

		if (skb_shared(skb))
		BUG();