X-Git-Url: https://pintos-os.org/cgi-bin/gitweb.cgi?a=blobdiff_plain;f=datapath%2Fdatapath.c;h=b25b8996e0735791ca64b7e6638d5d372678c17d;hb=926ea16ea3b38df0f34cdccdea92aa4933ca9dd4;hp=69b524c548f8612717b7e0b83b185a1e3bfb242b;hpb=d76195db5a0780626e2742b184b86aeae60972bc;p=openvswitch

diff --git a/datapath/datapath.c b/datapath/datapath.c
index 69b524c5..b25b8996 100644
--- a/datapath/datapath.c
+++ b/datapath/datapath.c
@@ -359,7 +359,6 @@ static void copy_and_csum_skb(struct sk_buff *skb, void *to)
 
 	get_skb_csum_pointers(skb, &csum_start, &csum_offset);
 	csum_start -= skb_headroom(skb);
-	BUG_ON(csum_start >= skb_headlen(skb));
 
 	skb_copy_bits(skb, 0, to, csum_start);
 
@@ -492,6 +491,9 @@ static int queue_control_packets(struct datapath *dp, struct sk_buff *skb,
 		if (unlikely(err))
 			goto err_kfree_skbs;
 
+		if (nla_attr_size(skb->len) > USHRT_MAX)
+			goto err_kfree_skbs;
+
 		len = sizeof(struct odp_header);
 		len += nla_total_size(skb->len);
 		len += nla_total_size(FLOW_BUFSIZE);
@@ -709,13 +711,13 @@ static int odp_packet_cmd_execute(struct sk_buff *skb, struct genl_info *info)
 	else
 		packet->protocol = htons(ETH_P_802_2);
 
+	/* Initialize OVS_CB (it came from Netlink so might not be zeroed). */
+	memset(OVS_CB(packet), 0, sizeof(struct ovs_skb_cb));
+
 	err = flow_extract(packet, -1, &key, &is_frag);
 	if (err)
 		goto exit;
 
-	/* Initialize OVS_CB (it came from Netlink so might not be zeroed). */
-	memset(OVS_CB(packet), 0, sizeof(struct ovs_skb_cb));
-
 	rcu_read_lock();
 	dp = get_dp(odp_header->dp_ifindex);
 	err = -ENODEV;