| Message ID | 20191008112309.9571-4-geokohma@cisco.com |
|---|---|
| State | Not Applicable |
| Delegated to: | David Miller |
| Headers | show |
| Series | net: ip6 defrag: backport fixes | expand |
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c index ec917f5..2842ccf 100644 --- a/net/ipv6/reassembly.c +++ b/net/ipv6/reassembly.c @@ -418,7 +418,8 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev, skb_network_header(head)[nhoff] = skb_transport_header(head)[0]; memmove(head->head + sizeof(struct frag_hdr), head->head, (head->data - head->head) - sizeof(struct frag_hdr)); - head->mac_header += sizeof(struct frag_hdr); + if (skb_mac_header_was_set(head)) + head->mac_header += sizeof(struct frag_hdr); head->network_header += sizeof(struct frag_hdr); skb_reset_transport_header(head);
commit b678aa578c9e ("ipv6: do not increment mac header when it's unset") Author: Jason A. Donenfeld <Jason@zx2c4.com> Date: Fri Oct 21 18:28:25 2016 +0900 Otherwise we'll overflow the integer. This occurs when layer 3 tunneled packets are handed off to the IPv6 layer. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> Signed-off-by: David S. Miller <davem@davemloft.net> --- net/ipv6/reassembly.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)