diff options
| -rw-r--r-- | drivers/net/tun.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/net/tun.c b/drivers/net/tun.c index 3f0cdc14be8..8d82511aa1b 100644 --- a/drivers/net/tun.c +++ b/drivers/net/tun.c @@ -565,6 +565,10 @@ static __inline__ ssize_t tun_get_user(struct tun_struct *tun, if (memcpy_fromiovecend((void *)&gso, iv, offset, sizeof(gso))) return -EFAULT; + if ((gso.flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) && + gso.csum_start + gso.csum_offset + 2 > gso.hdr_len) + gso.hdr_len = gso.csum_start + gso.csum_offset + 2; + if (gso.hdr_len > len) return -EINVAL; offset += sizeof(pi); |