[LLC]: bogus llc packet length

discard llc packet which has bogus packet length.

Signed-off-by: Joonwoo Park <[e-mail]>
Acked-by: Arnaldo Carvalho de Melo <[e-mail]>
Signed-off-by: David S. Miller <[e-mail]>

net/llc/llc_input.c

···
 	skb_pull(skb, llc_len);
 	if (skb->protocol == htons(ETH_P_802_2)) {
 		__be16 pdulen = eth_hdr(skb)->h_proto;
-		u16 data_size = ntohs(pdulen) - llc_len;
+		s32 data_size = ntohs(pdulen) - llc_len;
 
+		if (data_size < 0 ||
+		    ((skb_tail_pointer(skb) -
+		      (u8 *)pdu) - llc_len) < data_size)
+			return 0;
 		if (unlikely(pskb_trim_rcsum(skb, data_size)))
 			return 0;
 	}