| From 205035279be9921cb5e3d791aa20889135c2bcbf Mon Sep 17 00:00:00 2001 |
| From: Hannes Frederic Sowa <hannes@stressinduktion.org> |
| Date: Sun, 29 Sep 2013 05:40:50 +0200 |
| Subject: ipv6: gre: correct calculation of max_headroom |
| |
| From: Hannes Frederic Sowa <hannes@stressinduktion.org> |
| |
| [ Upstream commit 3da812d860755925da890e8c713f2d2e2d7b1bae ] |
| |
| gre_hlen already accounts for sizeof(struct ipv6_hdr) + gre header, |
| so initialize max_headroom to zero. Otherwise the |
| |
| if (encap_limit >= 0) { |
| max_headroom += 8; |
| mtu -= 8; |
| } |
| |
| increments an uninitialized variable before max_headroom was reset. |
| |
| Found with coverity: 728539 |
| |
| Cc: Dmitry Kozlov <xeb@mail.ru> |
| Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org> |
| Acked-by: Eric Dumazet <edumazet@google.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| net/ipv6/ip6_gre.c | 4 ++-- |
| 1 file changed, 2 insertions(+), 2 deletions(-) |
| |
| --- a/net/ipv6/ip6_gre.c |
| +++ b/net/ipv6/ip6_gre.c |
| @@ -620,7 +620,7 @@ static netdev_tx_t ip6gre_xmit2(struct s |
| struct ip6_tnl *tunnel = netdev_priv(dev); |
| struct net_device *tdev; /* Device to other host */ |
| struct ipv6hdr *ipv6h; /* Our new IP header */ |
| - unsigned int max_headroom; /* The extra header space needed */ |
| + unsigned int max_headroom = 0; /* The extra header space needed */ |
| int gre_hlen; |
| struct ipv6_tel_txoption opt; |
| int mtu; |
| @@ -693,7 +693,7 @@ static netdev_tx_t ip6gre_xmit2(struct s |
| tunnel->err_count = 0; |
| } |
| |
| - max_headroom = LL_RESERVED_SPACE(tdev) + gre_hlen + dst->header_len; |
| + max_headroom += LL_RESERVED_SPACE(tdev) + gre_hlen + dst->header_len; |
| |
| if (skb_headroom(skb) < max_headroom || skb_shared(skb) || |
| (skb_cloned(skb) && !skb_clone_writable(skb, 0))) { |
