From 21fd5e9d008d070166456a4628f816ed2efe2fcf Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Sun, 19 Aug 2012 03:47:30 +0000 Subject: [PATCH] --- yaml --- r: 327587 b: refs/heads/master c: b87fb39e399137257a6db3224ea854117e9486e9 h: refs/heads/master i: 327585: a1507f8ecfe5ade72700c1b2cd8fc95684285a1f 327583: 4acc2a59775e058e3ceff9ee26479e0b72a59148 v: v3 --- [refs] | 2 +- trunk/net/ipv6/ip6_gre.c | 8 +++++--- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/[refs] b/[refs] index 645e778aa74c..7f31d20dec60 100644 --- a/[refs] +++ b/[refs] @@ -1,2 +1,2 @@ --- -refs/heads/master: ef8531b64c3e2443da52e9f05d74a988230eedc5 +refs/heads/master: b87fb39e399137257a6db3224ea854117e9486e9 diff --git a/trunk/net/ipv6/ip6_gre.c b/trunk/net/ipv6/ip6_gre.c index a84ad5dc4fcf..424d11a4e7ff 100644 --- a/trunk/net/ipv6/ip6_gre.c +++ b/trunk/net/ipv6/ip6_gre.c @@ -415,8 +415,8 @@ static void ip6gre_err(struct sk_buff *skb, struct inet6_skb_parm *opt, u8 type, u8 code, int offset, __be32 info) { const struct ipv6hdr *ipv6h = (const struct ipv6hdr *)skb->data; - __be16 *p = (__be16 *)(ipv6h + 1); - int grehlen = sizeof(ipv6h) + 4; + __be16 *p = (__be16 *)(skb->data + offset); + int grehlen = offset + 4; struct ip6_tnl *t; __be16 flags; @@ -432,8 +432,10 @@ static void ip6gre_err(struct sk_buff *skb, struct inet6_skb_parm *opt, } /* If only 8 bytes returned, keyed message will be dropped here */ - if (skb_headlen(skb) < grehlen) + if (!pskb_may_pull(skb, grehlen)) return; + ipv6h = (const struct ipv6hdr *)skb->data; + p = (__be16 *)(skb->data + offset); rcu_read_lock();