diff options
| author | Jesse Gross <jesse@nicira.com> | 2011-02-28 14:32:33 -0800 |
|---|---|---|
| committer | Jesse Gross <jesse@nicira.com> | 2011-03-03 12:13:01 -0800 |
| commit | 513130154d7af9f5b58602aeb00765629479d02e (patch) | |
| tree | 443168a882961bbd96bc53cd9630fecc79ed3a8b /datapath/datapath.c | |
| parent | d76195db5a0780626e2742b184b86aeae60972bc (diff) | |
| download | openvswitch-513130154d7af9f5b58602aeb00765629479d02e.tar.gz | |
datapath: Check packet len does not exceed attribute len.
Netlink attributes have a maximum length of 64k. It's theoretically
possible that a packet could exceed this length, so check for it before
we try to send the packet to userspace.
Signed-off-by: Jesse Gross <jesse@nicira.com>
Acked-by: Ben Pfaff <blp@nicira.com>
Diffstat (limited to 'datapath/datapath.c')
| -rw-r--r-- | datapath/datapath.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/datapath/datapath.c b/datapath/datapath.c index 69b524c54..ebfc2e994 100644 --- a/datapath/datapath.c +++ b/datapath/datapath.c @@ -492,6 +492,9 @@ static int queue_control_packets(struct datapath *dp, struct sk_buff *skb, if (unlikely(err)) goto err_kfree_skbs; + if (nla_attr_size(skb->len) > USHRT_MAX) + goto err_kfree_skbs; + len = sizeof(struct odp_header); len += nla_total_size(skb->len); len += nla_total_size(FLOW_BUFSIZE); |