tree bb43f8374b6e157c5a412b30d2e528a808939067
parent 22cb99fb76fb56b38f59770fbf22be03bb796d8d
parent 4f0c40d94461cfd23893a17335b2ab78ecb333c8
author David S. Miller <davem@davemloft.net> 1468436021 -0700
committer David S. Miller <davem@davemloft.net> 1468436021 -0700

Merge branch 'sk_filter-trim-limit'

Willem de Bruijn says:

====================
limit sk_filter trim to payload

Sockets can apply a filter to incoming packets to drop or trim them.
Fix two codepaths that call skb_pull/__skb_pull after sk_filter
without checking for packet length.

Reading beyond skb->tail after trimming happens in more codepaths, but
safety of reading in the linear segment is based on minimum allocation
size (MAX_HEADER, GRO_MAX_HEAD, ..).
====================

Signed-off-by: David S. Miller <davem@davemloft.net>