diff options
| author | Linus Walleij <linus.walleij@linaro.org> | 2018-10-01 13:20:45 +0200 |
|---|---|---|
| committer | Linus Walleij <linus.walleij@linaro.org> | 2018-10-01 13:20:45 +0200 |
| commit | 30aa69e7bd9f7af3574120249eecb3726dcaf737 (patch) | |
| tree | b4a9ec1374ec9aed1022fdb32802c483952e5a97 /net/ipv6/ip6_tunnel.c | |
| parent | 63e037bc51b32d414cd07dd700e71359ce27a11f (diff) | |
| parent | 17b57b1883c1285f3d0dc2266e8f79286a7bef38 (diff) | |
| download | talos-obmc-linux-30aa69e7bd9f7af3574120249eecb3726dcaf737.tar.gz talos-obmc-linux-30aa69e7bd9f7af3574120249eecb3726dcaf737.zip | |
Merge tag 'v4.19-rc6' into devel
This is the 4.19-rc6 release
I needed to merge this in because of extensive conflicts in
the MSM and Intel pin control drivers. I know how to resolve
them, so let's do it like this.
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Diffstat (limited to 'net/ipv6/ip6_tunnel.c')
| -rw-r--r-- | net/ipv6/ip6_tunnel.c | 23 |
1 files changed, 20 insertions, 3 deletions
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c index 5df2a58d945c..a0b6932c3afd 100644 --- a/net/ipv6/ip6_tunnel.c +++ b/net/ipv6/ip6_tunnel.c @@ -1188,7 +1188,15 @@ route_lookup: init_tel_txopt(&opt, encap_limit); ipv6_push_frag_opts(skb, &opt.ops, &proto); } - hop_limit = hop_limit ? : ip6_dst_hoplimit(dst); + + if (hop_limit == 0) { + if (skb->protocol == htons(ETH_P_IP)) + hop_limit = ip_hdr(skb)->ttl; + else if (skb->protocol == htons(ETH_P_IPV6)) + hop_limit = ipv6_hdr(skb)->hop_limit; + else + hop_limit = ip6_dst_hoplimit(dst); + } /* Calculate max headroom for all the headers and adjust * needed_headroom if necessary. @@ -1226,7 +1234,7 @@ static inline int ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev) { struct ip6_tnl *t = netdev_priv(dev); - const struct iphdr *iph = ip_hdr(skb); + const struct iphdr *iph; int encap_limit = -1; struct flowi6 fl6; __u8 dsfield; @@ -1234,6 +1242,11 @@ ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev) u8 tproto; int err; + /* ensure we can access the full inner ip header */ + if (!pskb_may_pull(skb, sizeof(struct iphdr))) + return -1; + + iph = ip_hdr(skb); memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt)); tproto = READ_ONCE(t->parms.proto); @@ -1298,7 +1311,7 @@ static inline int ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev) { struct ip6_tnl *t = netdev_priv(dev); - struct ipv6hdr *ipv6h = ipv6_hdr(skb); + struct ipv6hdr *ipv6h; int encap_limit = -1; __u16 offset; struct flowi6 fl6; @@ -1307,6 +1320,10 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev) u8 tproto; int err; + if (unlikely(!pskb_may_pull(skb, sizeof(*ipv6h)))) + return -1; + + ipv6h = ipv6_hdr(skb); tproto = READ_ONCE(t->parms.proto); if ((tproto != IPPROTO_IPV6 && tproto != 0) || ip6_tnl_addr_conflict(t, ipv6h)) |
