|
@@ -578,19 +578,12 @@ static int ipv6_frag_rcv(struct sk_buff *skb)
|
|
|
IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_REASMREQDS);
|
|
|
|
|
|
/* Jumbo payload inhibits frag. header */
|
|
|
- if (hdr->payload_len==0) {
|
|
|
- IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_INHDRERRORS);
|
|
|
- icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
|
|
|
- skb_network_header_len(skb));
|
|
|
- return -1;
|
|
|
- }
|
|
|
+ if (hdr->payload_len==0)
|
|
|
+ goto fail_hdr;
|
|
|
+
|
|
|
if (!pskb_may_pull(skb, (skb_transport_offset(skb) +
|
|
|
- sizeof(struct frag_hdr)))) {
|
|
|
- IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_INHDRERRORS);
|
|
|
- icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
|
|
|
- skb_network_header_len(skb));
|
|
|
- return -1;
|
|
|
- }
|
|
|
+ sizeof(struct frag_hdr))))
|
|
|
+ goto fail_hdr;
|
|
|
|
|
|
hdr = ipv6_hdr(skb);
|
|
|
fhdr = (struct frag_hdr *)skb_transport_header(skb);
|
|
@@ -624,6 +617,11 @@ static int ipv6_frag_rcv(struct sk_buff *skb)
|
|
|
IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_REASMFAILS);
|
|
|
kfree_skb(skb);
|
|
|
return -1;
|
|
|
+
|
|
|
+fail_hdr:
|
|
|
+ IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_INHDRERRORS);
|
|
|
+ icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, skb_network_header_len(skb));
|
|
|
+ return -1;
|
|
|
}
|
|
|
|
|
|
static struct inet6_protocol frag_protocol =
|