diff options
| author | Kevin Hilman <khilman@linaro.org> | 2015-10-13 16:30:38 -0700 |
|---|---|---|
| committer | Kevin Hilman <khilman@linaro.org> | 2015-10-13 16:30:38 -0700 |
| commit | 575afa2b6b9b628766618f3da6c7289ab32f5661 (patch) | |
| tree | d4a23ddffc524e15b9a68b1aefa44da967fe7dd8 /net/ipv4/ip_fragment.c | |
| parent | c765e5c15e7d23d2b8b37fafdafc63c0ea75fabf (diff) | |
| parent | 1230ae0e99e05ced8a945a1a2c5762ce5c6c97c9 (diff) | |
Merge tag 'v3.14.54' of git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable into linux-linaro-lsk-v3.14lsk-v3.14-15.10
This is the 3.14.54 stable release
* tag 'v3.14.54' of git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable: (115 commits)
Linux 3.14.54
NVMe: Initialize device reference count earlier
udf: Check length of extended attributes and allocation descriptors
x86/nmi/64: Use DF to avoid userspace RSP confusing nested NMI detection
x86/nmi/64: Reorder nested NMI checks
x86/nmi/64: Improve nested NMI comments
x86/nmi/64: Switch stacks on userspace NMI entry
x86/nmi/64: Remove asm code that saves CR2
x86/nmi: Enable nested do_nmi() handling for 64-bit kernels
Revert "iio: bmg160: IIO_BUFFER and IIO_TRIGGERED_BUFFER are required"
net: gso: use feature flag argument in all protocol gso handlers
bna: fix interrupts storm caused by erroneous packets
udp: fix dst races with multicast early demux
rds: fix an integer overflow test in rds_info_getsockopt()
packet: missing dev_put() in packet_do_bind()
fib_rules: fix fib rule dumps across multiple skbs
openvswitch: Zero flows on allocation.
sctp: fix race on protocol/netns initialization
netlink, mmap: transform mmap skb into full skb on taps
net/ipv6: Correct PIM6 mrt_lock handling
...
Diffstat (limited to 'net/ipv4/ip_fragment.c')
| -rw-r--r-- | net/ipv4/ip_fragment.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c index 9ff497d17545..3f3a424ef0d5 100644 --- a/net/ipv4/ip_fragment.c +++ b/net/ipv4/ip_fragment.c @@ -357,7 +357,7 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb) ihl = ip_hdrlen(skb); /* Determine the position of this fragment. */ - end = offset + skb->len - ihl; + end = offset + skb->len - skb_network_offset(skb) - ihl; err = -EINVAL; /* Is this the final fragment? */ @@ -387,7 +387,7 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb) goto err; err = -ENOMEM; - if (pskb_pull(skb, ihl) == NULL) + if (!pskb_pull(skb, skb_network_offset(skb) + ihl)) goto err; err = pskb_trim_rcsum(skb, end - offset); @@ -628,6 +628,9 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev, iph->frag_off = qp->q.max_size ? htons(IP_DF) : 0; iph->tot_len = htons(len); iph->tos |= ecn; + + ip_send_check(iph); + IP_INC_STATS_BH(net, IPSTATS_MIB_REASMOKS); qp->q.fragments = NULL; qp->q.fragments_tail = NULL; |