Merge branch 'android-4.4' of https://android.googlesource.com/kernel/commonlsk-v4.4-16.02-android

* android-4.4: (475 commits)
  android: base-cfg: Add CONFIG_IP_MULTICAST
  android: recommended.cfg: enable taskstats
  ANDROID: android: base-cfg: disable CONFIG_SYSVIPC
  android: configs: base: enable configfs gadget functions
  android: add CONFIG_DEBUG_RODATA to recommended config
  android: configs: remove CONFIG_BATTERY_ANDROID=y
  android: configs: base: enable IPV6
  android: configs: Enable SELinux and its dependencies.
  android: base-cfg: disable ALARM_DEV
  android: base-cfg: turn off /dev/mem and /dev/kmem
  android: base-cfg: enable ARMV8_DEPRECATED and subfeatures
  android: base-cfg: enforce the needed XFRM_MODE_TUNNEL (for VPN)
  android: base-cfg: disable LOGGER
  android: base-cfg: enable DM_VERITY (used for secureboot)
  android: configs: add systrace support to recommended configs
  android: configs: update 3.10 options
  android: configs: Add CONFIG_NETFILTER_XT_TARGET_IDLETIMER
  android: configs: add IPV6 ROUTE INFO
  android: configs: add TIMER_STATS back, helps with sysrq t.
  android: configs: Add HIDRAW to recommended set
  ...

1 files changed, 8 insertions, 5 deletions

diff --git a/net/ipv6/exthdrs_core.c b/net/ipv6/exthdrs_core.c
index 5c5d23e59da5..835ec57c233b 100644
--- a/net/ipv6/exthdrs_core.c
+++ b/net/ipv6/exthdrs_core.c
@@ -166,15 +166,15 @@ EXPORT_SYMBOL_GPL(ipv6_find_tlv);
  * to explore inner IPv6 header, eg. ICMPv6 error messages.
  *
  * If target header is found, its offset is set in *offset and return protocol
- * number. Otherwise, return -1.
+ * number. Otherwise, return -ENOENT or -EBADMSG.
  *
  * If the first fragment doesn't contain the final protocol header or
  * NEXTHDR_NONE it is considered invalid.
  *
  * Note that non-1st fragment is special case that "the protocol number
  * of last header" is "next header" field in Fragment header. In this case,
- * *offset is meaningless and fragment offset is stored in *fragoff if fragoff
- * isn't NULL.
+ * *offset is meaningless. If fragoff is not NULL, the fragment offset is
+ * stored in *fragoff; if it is NULL, return -EINVAL.
  *
  * if flags is not NULL and it's a fragment, then the frag flag
  * IP6_FH_F_FRAG will be set. If it's an AH header, the
@@ -253,9 +253,12 @@ int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
 				if (target < 0 &&
 				    ((!ipv6_ext_hdr(hp->nexthdr)) ||
 				     hp->nexthdr == NEXTHDR_NONE)) {
-					if (fragoff)
+					if (fragoff) {
 						*fragoff = _frag_off;
-					return hp->nexthdr;
+						return hp->nexthdr;
+					} else {
+						return -EINVAL;
+					}
 				}
 				return -ENOENT;
 			}