aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorShan Wei <shanwei@cn.fujitsu.com>2011-04-19 22:52:49 +0000
committerGreg Kroah-Hartman <gregkh@suse.de>2011-11-26 09:10:36 -0800
commit85c269fa465918e1ba4668cf8c04de68e7b2298d (patch)
tree0cb84681ae15e5e600383a796ff70a2cef51a1f1
parentf26b4e9506488626dfaacd6733f7e963f4c4ffc2 (diff)
ipv6: udp: fix the wrong headroom check
commit a9cf73ea7ff78f52662c8658d93c226effbbedde upstream. At this point, skb->data points to skb_transport_header. So, headroom check is wrong. For some case:bridge(UFO is on) + eth device(UFO is off), there is no enough headroom for IPv6 frag head. But headroom check is always false. This will bring about data be moved to there prior to skb->head, when adding IPv6 frag header to skb. Signed-off-by: Shan Wei <shanwei@cn.fujitsu.com> Acked-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-rw-r--r--net/ipv6/udp.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index ca520d4d906..9cc6289acae 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -1141,7 +1141,7 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb, int features)
skb->ip_summed = CHECKSUM_NONE;
/* Check if there is enough headroom to insert fragment header. */
- if ((skb_headroom(skb) < frag_hdr_sz) &&
+ if ((skb_mac_header(skb) < skb->head + frag_hdr_sz) &&
pskb_expand_head(skb, frag_hdr_sz, 0, GFP_ATOMIC))
goto out;