39 lines
1.2 KiB
Diff
39 lines
1.2 KiB
Diff
From 33710d0cfda2e00144acf7b6c58bb86ea4fcbbac Mon Sep 17 00:00:00 2001
|
|
From: Shan Wei <shanwei@cn.fujitsu.com>
|
|
Date: Tue, 19 Apr 2011 22:52:49 +0000
|
|
Subject: [PATCH] ipv6: udp: fix the wrong headroom check
|
|
|
|
At this point, skb->data points to skb_transport_header.
|
|
So, headroom check is wrong.
|
|
|
|
For some case:bridge(UFO is on) + eth device(UFO is off),
|
|
there is no enough headroom for IPv6 frag head.
|
|
But headroom check is always false.
|
|
|
|
This will bring about data be moved to there prior to skb->head,
|
|
when adding IPv6 frag header to skb.
|
|
|
|
Signed-off-by: Shan Wei <shanwei@cn.fujitsu.com>
|
|
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
|
|
Signed-off-by: David S. Miller <davem@davemloft.net>
|
|
---
|
|
net/ipv6/udp.c | 2 +-
|
|
1 files changed, 1 insertions(+), 1 deletions(-)
|
|
|
|
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
|
|
index 8a72f58..4aaae95 100644
|
|
--- a/net/ipv6/udp.c
|
|
+++ b/net/ipv6/udp.c
|
|
@@ -1339,7 +1339,7 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb, int features)
|
|
skb->ip_summed = CHECKSUM_NONE;
|
|
|
|
/* Check if there is enough headroom to insert fragment header. */
|
|
- if ((skb_headroom(skb) < frag_hdr_sz) &&
|
|
+ if ((skb_mac_header(skb) < skb->head + frag_hdr_sz) &&
|
|
pskb_expand_head(skb, frag_hdr_sz, 0, GFP_ATOMIC))
|
|
goto out;
|
|
|
|
--
|
|
1.7.7.1
|
|
|