diff options
| author | David S. Miller <davem@davemloft.net> | 2010-09-27 01:03:03 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2010-09-27 01:03:03 -0700 |
| commit | e40051d134f7ee95c8c1f7a3471e84eafc9ab326 (patch) | |
| tree | 88eb44e49a75721ae926665a2c42f08badac9d07 /drivers/net/bonding | |
| parent | 42099d7a3941d4aaf853caac92b3ae76149fc6e7 (diff) | |
| parent | 2cc6d2bf3d6195fabcf0febc192c01f99519a8f3 (diff) | |
Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6
Conflicts:
drivers/net/qlcnic/qlcnic_init.c
net/ipv4/ip_output.c
Diffstat (limited to 'drivers/net/bonding')
| -rw-r--r-- | drivers/net/bonding/bond_3ad.c | 3 | ||||
| -rw-r--r-- | drivers/net/bonding/bond_alb.c | 3 |
2 files changed, 6 insertions, 0 deletions
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c index 2a47c1deb9f..079b9d1eead 100644 --- a/drivers/net/bonding/bond_3ad.c +++ b/drivers/net/bonding/bond_3ad.c @@ -2466,6 +2466,9 @@ int bond_3ad_lacpdu_recv(struct sk_buff *skb, struct net_device *dev, struct pac if (!(dev->flags & IFF_MASTER)) goto out; + if (!pskb_may_pull(skb, sizeof(struct lacpdu))) + goto out; + read_lock(&bond->lock); slave = bond_get_slave_by_dev((struct bonding *)netdev_priv(dev), orig_dev); diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c index c746b331771..26bb118c453 100644 --- a/drivers/net/bonding/bond_alb.c +++ b/drivers/net/bonding/bond_alb.c @@ -362,6 +362,9 @@ static int rlb_arp_recv(struct sk_buff *skb, struct net_device *bond_dev, struct goto out; } + if (!pskb_may_pull(skb, arp_hdr_len(bond_dev))) + goto out; + if (skb->len < sizeof(struct arp_pkt)) { pr_debug("Packet is too small to be an ARP\n"); goto out; |