Commit a9cf73ea authored Apr 19, 2011 by Shan Wei Committed by David S. Miller Apr 21, 2011

ipv6: udp: fix the wrong headroom check



At this point, skb->data points to skb_transport_header.
So, headroom check is wrong.

For some case:bridge(UFO is on) + eth device(UFO is off),
there is no enough headroom for IPv6 frag head.
But headroom check is always false.

This will bring about data be moved to there prior to skb->head,
when adding IPv6 frag header to skb.

Signed-off-by: Shan Wei <shanwei@cn.fujitsu.com>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 10022a6c

net/ipv6/udp.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -1335,7 +1335,7 @@ static struct sk_buff udp6_ufo_fragment(struct sk_buff skb, u32 features)
		skb->ip_summed = CHECKSUM_NONE;

		/* Check if there is enough headroom to insert fragment header. */
		if ((skb_headroom(skb) < frag_hdr_sz) &&
		if ((skb_mac_header(skb) < skb->head + frag_hdr_sz) &&
		pskb_expand_head(skb, frag_hdr_sz, 0, GFP_ATOMIC))
		goto out;

Admin message