xfrm6: Fix ICMPv6 and MH header checks in _decode_session6

Ensure there's enough data left prior calling pskb_may_pull(). If
skb->data was already advanced, we'll call pskb_may_pull() with a
negative value converted to unsigned int -- leading to a huge
positive value. That won't matter in practice as pskb_may_pull()
will likely fail in this case, but it leads to underflow reports on
kernels handling such kind of over-/underflows, e.g. a PaX enabled
kernel instrumented with the size_overflow plugin.

Reported-by: satmd <[email protected]>
Reported-and-tested-by: Marcin Jurkowski <[email protected]>
Signed-off-by: Mathias Krause <[email protected]>
Cc: PaX Team <[email protected]>
Signed-off-by: Steffen Klassert <[email protected]>

0 files changed, 0 insertions, 0 deletions