net: flow_dissector: fail on evil iph->ihl
net: flow_dissector: fail on evil iph->ihl

We don't validate iph->ihl which may lead a dead loop if we meet a IPIP
skb whose iph->ihl is zero. Fix this by failing immediately when iph->ihl
is evil (less than 5).

This issue were introduced by commit ec5efe7946280d1e84603389a1030ccec0a767ae
(rps: support IPIP encapsulation).

Cc: Eric Dumazet <312c7d941f03386814be517ffdb3e0eb6624e275@google.com>
Cc: Petr Matousek <d1ac682bce3c8307a4378440a11ce4c6d399629c@redhat.com>
Cc: Michael S. Tsirkin <255103e50249e3d658441816e0597170ebfc16ef@redhat.com>
Cc: Daniel Borkmann <9ff04a02a69f376b2b9aeec27187017cbf3cf5f9@redhat.com>
Signed-off-by: Jason Wang <808efd45667dbd241e4e026b5673172419ecb43e@redhat.com>
Acked-by: Eric Dumazet <312c7d941f03386814be517ffdb3e0eb6624e275@google.com>
Signed-off-by: David S. Miller <fe08d3c717adf2ae63592e4c9aec6e3e404d8e3e@davemloft.net>

KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs