Ensure the entire TLV header is linearized before access by adding
sizeof(struct hsr_sup_tlv) to the pskb_may_pull() calls. Without this,
a truncated frame could cause an out-of-bounds access.
Fixes:
|
||
|---|---|---|
| .. | ||
| Kconfig | ||
| Makefile | ||
| hsr_debugfs.c | ||
| hsr_device.c | ||
| hsr_device.h | ||
| hsr_forward.c | ||
| hsr_forward.h | ||
| hsr_framereg.c | ||
| hsr_framereg.h | ||
| hsr_main.c | ||
| hsr_main.h | ||
| hsr_netlink.c | ||
| hsr_netlink.h | ||
| hsr_slave.c | ||
| hsr_slave.h | ||
| prp_dup_discard_test.c | ||