[PATCHv2 net 3/3] net: sched: ife: check on metadata length

[Alexander Aring]

This patch checks if sk buffer is available to dererence ife header. If
not then NULL will returned to signal an malformed ife packet. This
avoids to crashing the kernel from outside.

Signed-off-by: Alexander Aring <ar...@mojatatu.com>
Reviewed-by: Yotam Gigi <yotam...@gmail.com>
Acked-by: Jamal Hadi Salim <j...@mojatatu.com>
---
 net/ife/ife.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/ife/ife.c b/net/ife/ife.c
index 7fbe70a0af4b..93e8c36ce6ec 100644
--- a/net/ife/ife.c
+++ b/net/ife/ife.c
@@ -70,6 +70,9 @@ void *ife_decode(struct sk_buff *skb, u16 *metalen)
        u16 ifehdrln;
 
        ifehdr = (struct ifeheadr *) (skb->data + skb->dev->hard_header_len);
+       if (skb->len < skb->dev->hard_header_len + IFE_METAHDRLEN)
+               return NULL;
+
        ifehdrln = ntohs(ifehdr->metalen);
        total_pull = skb->dev->hard_header_len + ifehdrln;
 
-- 
2.11.0