summaryrefslogtreecommitdiff
path: root/net/ipv6
diff options
context:
space:
mode:
authorShan Wei <shanwei@cn.fujitsu.com>2011-04-19 22:52:49 +0000
committerDavid S. Miller <davem@davemloft.net>2011-04-21 10:39:10 -0700
commita9cf73ea7ff78f52662c8658d93c226effbbedde (patch)
tree07a723cb628f223e4f756f0cb02eeba8b6ee9c62 /net/ipv6
parent10022a6c66e199d8f61d9044543f38785713cbbd (diff)
ipv6: udp: fix the wrong headroom check
At this point, skb->data points to skb_transport_header. So, headroom check is wrong. For some case:bridge(UFO is on) + eth device(UFO is off), there is no enough headroom for IPv6 frag head. But headroom check is always false. This will bring about data be moved to there prior to skb->head, when adding IPv6 frag header to skb. Signed-off-by: Shan Wei <shanwei@cn.fujitsu.com> Acked-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv6')
-rw-r--r--net/ipv6/udp.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 15c37746845e..9e305d74b3d4 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -1335,7 +1335,7 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb, u32 features)
skb->ip_summed = CHECKSUM_NONE;
/* Check if there is enough headroom to insert fragment header. */
- if ((skb_headroom(skb) < frag_hdr_sz) &&
+ if ((skb_mac_header(skb) < skb->head + frag_hdr_sz) &&
pskb_expand_head(skb, frag_hdr_sz, 0, GFP_ATOMIC))
goto out;