git.ipfire.org Git - thirdparty/kernel/stable-queue.git/blob

   1 From foo@baz Tue Mar 24 11:00:07 CET 2015
   2 From: Sabrina Dubroca <sd@queasysnail.net>
   3 Date: Thu, 19 Mar 2015 11:22:32 +0100
   4 Subject: ipv6: call ipv6_proxy_select_ident instead of ipv6_select_ident in udp6_ufo_fragment
   5
   6 From: Sabrina Dubroca <sd@queasysnail.net>
   7
   8 [ Upstream commit 8e199dfd82ee097b522b00344af6448715d8ee0c ]
   9
  10 Matt Grant reported frequent crashes in ipv6_select_ident when
  11 udp6_ufo_fragment is called from openvswitch on a skb that doesn't
  12 have a dst_entry set.
  13
  14 ipv6_proxy_select_ident generates the frag_id without using the dst
  15 associated with the skb.  This approach was suggested by Vladislav
  16 Yasevich.
  17
  18 Fixes: 0508c07f5e0c ("ipv6: Select fragment id during UFO segmentation if not set.")
  19 Cc: Vladislav Yasevich <vyasevic@redhat.com>
  20 Reported-by: Matt Grant <matt@mattgrant.net.nz>
  21 Tested-by: Matt Grant <matt@mattgrant.net.nz>
  22 Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
  23 Acked-by: Vladislav Yasevich <vyasevic@redhat.com>
  24 Signed-off-by: David S. Miller <davem@davemloft.net>
  25 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  26 ---
  27  net/ipv6/udp_offload.c |    8 +++-----
  28  1 file changed, 3 insertions(+), 5 deletions(-)
  29
  30 --- a/net/ipv6/udp_offload.c
  31 +++ b/net/ipv6/udp_offload.c
  32 @@ -112,11 +112,9 @@ static struct sk_buff *udp6_ufo_fragment
  33                 fptr = (struct frag_hdr *)(skb_network_header(skb) + unfrag_ip6hlen);
  34                 fptr->nexthdr = nexthdr;
  35                 fptr->reserved = 0;
  36 -               if (skb_shinfo(skb)->ip6_frag_id)
  37 -                       fptr->identification = skb_shinfo(skb)->ip6_frag_id;
  38 -               else
  39 -                       ipv6_select_ident(fptr,
  40 -                                         (struct rt6_info *)skb_dst(skb));
  41 +               if (!skb_shinfo(skb)->ip6_frag_id)
  42 +                       ipv6_proxy_select_ident(skb);
  43 +               fptr->identification = skb_shinfo(skb)->ip6_frag_id;
  44
  45                 /* Fragment the skb. ipv6 header and the remaining fields of the
  46                  * fragment header are updated in ipv6_gso_segment()