Message ID | 4697d0324d0b4313cbc2053b49ac85ec955b81cb.1459872592.git.jkbs@redhat.com |
---|---|
State | Accepted, archived |
Delegated to: | David Miller |
Headers | show |
From: Jakub Sitnicki <jkbs@redhat.com> Date: Tue, 5 Apr 2016 18:41:08 +0200 > When sending a UDPv6 message longer than MTU, account for the length > of fragmentable IPv6 extension headers in skb->network_header offset. > Same as we do in alloc_new_skb path in __ip6_append_data(). > > This ensures that later on __ip6_make_skb() will make space in > headroom for fragmentable extension headers: > > /* move skb->data to ip header from ext header */ > if (skb->data < skb_network_header(skb)) > __skb_pull(skb, skb_network_offset(skb)); > > Prevents a splat due to skb_under_panic: ... > Reported-by: Ji Jianwen <jiji@redhat.com> > Signed-off-by: Jakub Sitnicki <jkbs@redhat.com> > Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Applied and queued up for -stable, thanks.
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c index 9428345..bc972e7 100644 --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c @@ -1090,8 +1090,8 @@ static inline int ip6_ufo_append_data(struct sock *sk, int getfrag(void *from, char *to, int offset, int len, int odd, struct sk_buff *skb), void *from, int length, int hh_len, int fragheaderlen, - int transhdrlen, int mtu, unsigned int flags, - const struct flowi6 *fl6) + int exthdrlen, int transhdrlen, int mtu, + unsigned int flags, const struct flowi6 *fl6) { struct sk_buff *skb; @@ -1116,7 +1116,7 @@ static inline int ip6_ufo_append_data(struct sock *sk, skb_put(skb, fragheaderlen + transhdrlen); /* initialize network header pointer */ - skb_reset_network_header(skb); + skb_set_network_header(skb, exthdrlen); /* initialize protocol header pointer */ skb->transport_header = skb->network_header + fragheaderlen; @@ -1358,7 +1358,7 @@ emsgsize: (rt->dst.dev->features & NETIF_F_UFO) && (sk->sk_type == SOCK_DGRAM) && !udp_get_no_check6_tx(sk)) { err = ip6_ufo_append_data(sk, queue, getfrag, from, length, - hh_len, fragheaderlen, + hh_len, fragheaderlen, exthdrlen, transhdrlen, mtu, flags, fl6); if (err) goto error;