---

yaml --- r: 327587 b: refs/heads/master c: b87fb39 h: refs/heads/master i: 327585: a1507f8 327583: 4acc2a5 v: v3
git-mirror · Aug 23, 2012 · 21fd5e9 · 21fd5e9
1 parent a1df56a
commit 21fd5e9
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 4 deletions.
diff --git a/[refs] b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: ef8531b64c3e2443da52e9f05d74a988230eedc5
+refs/heads/master: b87fb39e399137257a6db3224ea854117e9486e9
diff --git a/trunk/net/ipv6/ip6_gre.c b/trunk/net/ipv6/ip6_gre.c
@@ -415,8 +415,8 @@ static void ip6gre_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 		u8 type, u8 code, int offset, __be32 info)
 {
 	const struct ipv6hdr *ipv6h = (const struct ipv6hdr *)skb->data;
-	__be16 *p = (__be16 *)(ipv6h + 1);
-	int grehlen = sizeof(ipv6h) + 4;
+	__be16 *p = (__be16 *)(skb->data + offset);
+	int grehlen = offset + 4;
 	struct ip6_tnl *t;
 	__be16 flags;
 
@@ -432,8 +432,10 @@ static void ip6gre_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 	}
 
 	/* If only 8 bytes returned, keyed message will be dropped here */
-	if (skb_headlen(skb) < grehlen)
+	if (!pskb_may_pull(skb, grehlen))
 		return;
+	ipv6h = (const struct ipv6hdr *)skb->data;
+	p = (__be16 *)(skb->data + offset);
 
 	rcu_read_lock();