summaryrefslogtreecommitdiff
path: root/net/ipv6/udp_offload.c
diff options
context:
space:
mode:
authorHannes Frederic Sowa <hannes@stressinduktion.org>2013-11-05 05:41:27 +0400
committerDavid S. Miller <davem@davemloft.net>2013-11-06 07:09:53 +0400
commit0e033e04c2678dbbe74a46b23fffb7bb918c288e (patch)
tree2adab459e35b2668b3ebb02c6156d5787e55c628 /net/ipv6/udp_offload.c
parent1cce16d37d0fe2668787d64ad172c5be6973aeca (diff)
downloadlinux-0e033e04c2678dbbe74a46b23fffb7bb918c288e.tar.xz
ipv6: fix headroom calculation in udp6_ufo_fragment
Commit 1e2bd517c108816220f262d7954b697af03b5f9c ("udp6: Fix udp fragmentation for tunnel traffic.") changed the calculation if there is enough space to include a fragment header in the skb from a skb->mac_header dervived one to skb_headroom. Because we already peeled off the skb to transport_header this is wrong. Change this back to check if we have enough room before the mac_header. This fixes a panic Saran Neti reported. He used the tbf scheduler which skb_gso_segments the skb. The offsets get negative and we panic in memcpy because the skb was erroneously not expanded at the head. Reported-by: Saran Neti <Saran.Neti@telus.com> Cc: Pravin B Shelar <pshelar@nicira.com> Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv6/udp_offload.c')
-rw-r--r--net/ipv6/udp_offload.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/net/ipv6/udp_offload.c b/net/ipv6/udp_offload.c
index 08e23b0bf302..e7359f9eaa8d 100644
--- a/net/ipv6/udp_offload.c
+++ b/net/ipv6/udp_offload.c
@@ -90,7 +90,7 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,
/* Check if there is enough headroom to insert fragment header. */
tnl_hlen = skb_tnl_header_len(skb);
- if (skb_headroom(skb) < (tnl_hlen + frag_hdr_sz)) {
+ if (skb->mac_header < (tnl_hlen + frag_hdr_sz)) {
if (gso_pskb_expand_head(skb, tnl_hlen + frag_hdr_sz))
goto out;
}