summaryrefslogtreecommitdiff
path: root/net/ipv4/ipmr.c
diff options
context:
space:
mode:
authorSimon Horman <horms@verge.net.au>2013-05-28 20:34:29 (GMT)
committerDavid S. Miller <davem@davemloft.net>2013-05-29 06:49:07 (GMT)
commit7cc461900549fc480eb133948649a1edb7eaaa6f (patch)
tree32782f0156c0eb27b2b188d7882e9c2e77d7c8c5 /net/ipv4/ipmr.c
parent158874cac61245b84e939c92c53db7000122b7b0 (diff)
downloadlinux-7cc461900549fc480eb133948649a1edb7eaaa6f.tar.xz
net, ipv4, ipv6: Correct assignment of skb->network_header to skb->tail
This corrects an regression introduced by "net: Use 16bits for *_headers fields of struct skbuff" when NET_SKBUFF_DATA_USES_OFFSET is not set. In that case skb->tail will be a pointer however skb->network_header is now an offset. This patch corrects the problem by adding a wrapper to return skb tail as an offset regardless of the value of NET_SKBUFF_DATA_USES_OFFSET. It seems that skb->tail that this offset may be more than 64k and some care has been taken to treat such cases as an error. Signed-off-by: Simon Horman <horms@verge.net.au> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4/ipmr.c')
-rw-r--r--net/ipv4/ipmr.c8
1 files changed, 7 insertions, 1 deletions
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index f975399..df97f0a 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -945,6 +945,7 @@ static int ipmr_cache_report(struct mr_table *mrt,
struct igmpmsg *msg;
struct sock *mroute_sk;
int ret;
+ unsigned long tail_offset;
#ifdef CONFIG_IP_PIMSM
if (assert == IGMPMSG_WHOLEPKT)
@@ -980,7 +981,12 @@ static int ipmr_cache_report(struct mr_table *mrt,
/* Copy the IP header */
- skb->network_header = skb->tail;
+ tail_offset = skb_tail_offset(skb);
+ if (tail_offset > 0xffff) {
+ kfree_skb(skb);
+ return -EINVAL;
+ }
+ skb_set_network_header(skb, tail_offset);
skb_put(skb, ihl);
skb_copy_to_linear_data(skb, pkt->data, ihl);
ip_hdr(skb)->protocol = 0; /* Flag to the kernel this is a route add */