[ICMP]: Restore pskb_pull calls in receive function

Somewhere along the development of my ICMP relookup patch the header
length check went AWOL on the non-IPsec path.  This patch restores the
check.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index a7321a82df6d24b3a1921d3918c23412b4271a4c..a13c074dac091e21fb1bb3cb1c77715ded13a5c2 100644 (file)
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -1015,7 +1015,8 @@ int icmp_rcv(struct sk_buff *skb)
                        goto error;
        }
 
-       __skb_pull(skb, sizeof(*icmph));
+       if (!pskb_pull(skb, sizeof(*icmph)))
+               goto error;
 
        icmph = icmp_hdr(skb);
 

diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index cbb5b9cf84ad36eba8741bec98cb2409040d3c93..121d517bf91c9d16467c5aa85df47efdd0b6c58e 100644 (file)
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -683,7 +683,8 @@ static int icmpv6_rcv(struct sk_buff *skb)
                }
        }
 
-       __skb_pull(skb, sizeof(*hdr));
+       if (!pskb_pull(skb, sizeof(*hdr)))
+               goto discard_it;
 
        hdr = icmp6_hdr(skb);