Patchwork ipv6: fix headroom calculation in udp6_ufo_fragment

login
register
mail settings
Submitter Mark Hambleton
Date Dec. 13, 2013, 3 p.m.
Message ID <D00A5DFD97C44C4D820FC3A847C5D575073065F5@IRVEXCHMB14.corp.ad.broadcom.com>
Download mbox | patch
Permalink /patch/301057/
State Not Applicable
Delegated to: David Miller
Headers show

Comments

Mark Hambleton - Dec. 13, 2013, 3 p.m.
Thanks!

That fixes the warning and looks like it will work.

Mark

-----Original Message-----
From: Hannes Frederic Sowa [mailto:hannes@stressinduktion.org] 

Sent: 13 December 2013 14:12
To: Mark Brown
Cc: Mark Hambleton; 'Pravin B Shelar'; 'Saran Neti'; 'David S. Miller'; 'Greg Kroah-Hartman'; 'netdev@vger.kernel.org'; 'stable@vger.kernel.org'
Subject: Re: ipv6: fix headroom calculation in udp6_ufo_fragment

On Fri, Dec 13, 2013 at 01:42:05PM +0000, Mark Brown wrote:
> On Fri, Dec 13, 2013 at 02:34:53PM +0100, Hannes Frederic Sowa wrote:

> 

> > Sorry, I don't know which version the LTS kernel is. Upstream does not use

> > sk_buff_data_t for mac_header any more.

> 

> This is with v3.10.


The change happend in 3.11. So I guess it was an oversight while backporting.
Following patch should help and should get backported to all stable kernels
<= 3.10.

[PATCH stable] ipv6: fix illegal mac_header comparison on 32bit

Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>

---

Patch intended for stable kernel <= 3.10.

 net/ipv6/udp_offload.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

-- 
1.8.3.1

Patch

diff --git a/net/ipv6/udp_offload.c b/net/ipv6/udp_offload.c

index e7359f9..e15a357 100644

--- a/net/ipv6/udp_offload.c

+++ b/net/ipv6/udp_offload.c

@@ -90,7 +90,7 @@  static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,

 
 		/* Check if there is enough headroom to insert fragment header. */
 		tnl_hlen = skb_tnl_header_len(skb);
-		if (skb->mac_header < (tnl_hlen + frag_hdr_sz)) {

+		if (skb_mac_header(skb) < skb->head + tnl_hlen + frag_hdr_sz) {

 			if (gso_pskb_expand_head(skb, tnl_hlen + frag_hdr_sz))
 				goto out;
 		}