@@ -68,6 +68,7 @@ static int bareudp_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
6868 __be16 proto ;
6969 void * oiph ;
7070 int err ;
71+ int nh ;
7172
7273 bareudp = rcu_dereference_sk_user_data (sk );
7374 if (!bareudp )
@@ -148,10 +149,25 @@ static int bareudp_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
148149 }
149150 skb_dst_set (skb , & tun_dst -> dst );
150151 skb -> dev = bareudp -> dev ;
151- oiph = skb_network_header (skb );
152- skb_reset_network_header (skb );
153152 skb_reset_mac_header (skb );
154153
154+ /* Save offset of outer header relative to skb->head,
155+ * because we are going to reset the network header to the inner header
156+ * and might change skb->head.
157+ */
158+ nh = skb_network_header (skb ) - skb -> head ;
159+
160+ skb_reset_network_header (skb );
161+
162+ if (!pskb_inet_may_pull (skb )) {
163+ DEV_STATS_INC (bareudp -> dev , rx_length_errors );
164+ DEV_STATS_INC (bareudp -> dev , rx_errors );
165+ goto drop ;
166+ }
167+
168+ /* Get the outer header. */
169+ oiph = skb -> head + nh ;
170+
155171 if (!ipv6_mod_enabled () || family == AF_INET )
156172 err = IP_ECN_decapsulate (oiph , skb );
157173 else
@@ -301,6 +317,9 @@ static int bareudp_xmit_skb(struct sk_buff *skb, struct net_device *dev,
301317 __be32 saddr ;
302318 int err ;
303319
320+ if (!skb_vlan_inet_prepare (skb , skb -> protocol != htons (ETH_P_TEB )))
321+ return - EINVAL ;
322+
304323 if (!sock )
305324 return - ESHUTDOWN ;
306325
@@ -368,6 +387,9 @@ static int bareudp6_xmit_skb(struct sk_buff *skb, struct net_device *dev,
368387 __be16 sport ;
369388 int err ;
370389
390+ if (!skb_vlan_inet_prepare (skb , skb -> protocol != htons (ETH_P_TEB )))
391+ return - EINVAL ;
392+
371393 if (!sock )
372394 return - ESHUTDOWN ;
373395
0 commit comments