diff --git a/net/sctp/input.c b/net/sctp/input.c index 9494cfa51106..6f66ae656d70 100644 --- a/net/sctp/input.c +++ b/net/sctp/input.c @@ -116,8 +116,13 @@ int sctp_rcv(struct sk_buff *skb) /* If the packet is fragmented and we need to do crc checking, * it's better to just linearize it otherwise crc computing * takes longer. + * + * If there is a geometry mismatch, length discrepancy, or offset corruption + * in the packet, skb_linearize will fail and return + * a non-zero error code. */ - if (((!is_gso || skb_cloned(skb)) && skb_linearize(skb)) || + + if (((!is_gso || skb_cloned(skb)) && skb_linearize(skb) != 0) || !pskb_may_pull(skb, sizeof(struct sctphdr))) goto discard_it;