gro: Only reset frag0 when skb can be pulled, CVE-2011-2723
authorHerbert Xu <herbert@gondor.apana.org.au>
Tue, 13 Sep 2011 16:48:44 +0000 (17:48 +0100)
committerHerton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
Tue, 27 Sep 2011 19:13:54 +0000 (16:13 -0300)
commit219b5d87ae3e68d17107ffce5181bbd6e1a9790d
treec57fe11f1ad248cd42564c856b7767369786f0b1
parentd4137251f8d762dc3469cd92cff7c66fce3752a9
gro: Only reset frag0 when skb can be pulled, CVE-2011-2723

Currently skb_gro_header_slow unconditionally resets frag0 and
frag0_len.  However, when we can't pull on the skb this leaves
the GRO fields in an inconsistent state.

This patch fixes this by only resetting those fields after the
pskb_may_pull test.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

(cherry picked from commit 17dd759c67f21e34f2156abcf415e1f60605a188)
CVE-2011-2723
BugLink: http://bugs.launchpad.net/bugs/844371
Signed-off-by: Andy Whitcroft <apw@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
include/linux/netdevice.h