diff options
| author | Florian Westphal <fw@strlen.de> | 2017-03-22 11:31:13 +0000 |
|---|---|---|
| committer | android-build-merger <android-build-merger@google.com> | 2017-03-22 11:31:13 +0000 |
| commit | 2a862f56b13115e830bfcd50bd049220104dede4 (patch) | |
| tree | a47e9b1838e78b8ef5a87eeb33d1f4faf95a8198 | |
| parent | e8f6f65c8ea5faf64f21f0cd672ecdc9c94555b2 (diff) | |
| parent | aed728c38c483650885dfd975dd9f4903e5505bf (diff) | |
ipv6: avoid write to a possibly cloned skb
am: aed728c38c
Change-Id: I7bbff2dcff94ea2804d3f21cd0341379332a47e6
| -rw-r--r-- | net/ipv6/ip6_output.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c index 58900c21e4e4..8004532fa882 100644 --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c @@ -742,13 +742,14 @@ slow_path: * Fragment the datagram. */ - *prevhdr = NEXTHDR_FRAGMENT; troom = rt->dst.dev->needed_tailroom; /* * Keep copying data until we run out. */ while (left > 0) { + u8 *fragnexthdr_offset; + len = left; /* IF: it doesn't fit, use 'mtu' - the data space left */ if (len > mtu) @@ -793,6 +794,10 @@ slow_path: */ skb_copy_from_linear_data(skb, skb_network_header(frag), hlen); + fragnexthdr_offset = skb_network_header(frag); + fragnexthdr_offset += prevhdr - skb_network_header(skb); + *fragnexthdr_offset = NEXTHDR_FRAGMENT; + /* * Build fragment header. */ |