Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

[uclinux-h8/linux.git] / net / ipv6 / ip6_vti.c

diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index eeaf745..8b6eeff 100644 (file)
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -318,6 +318,7 @@ static int vti6_rcv(struct sk_buff *skb)
                        return 0;
                }
 
+               ipv6h = ipv6_hdr(skb);
                if (!ip6_tnl_rcv_ctl(t, &ipv6h->daddr, &ipv6h->saddr)) {
                        t->dev->stats.rx_dropped++;
                        rcu_read_unlock();
@@ -521,18 +522,18 @@ vti6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
 {
        struct ip6_tnl *t = netdev_priv(dev);
        struct net_device_stats *stats = &t->dev->stats;
-       struct ipv6hdr *ipv6h;
        struct flowi fl;
        int ret;
 
+       if (!pskb_inet_may_pull(skb))
+               goto tx_err;
+
        memset(&fl, 0, sizeof(fl));
 
        switch (skb->protocol) {
        case htons(ETH_P_IPV6):
-               ipv6h = ipv6_hdr(skb);
-
                if ((t->parms.proto != IPPROTO_IPV6 && t->parms.proto != 0) ||
-                   vti6_addr_conflict(t, ipv6h))
+                   vti6_addr_conflict(t, ipv6_hdr(skb)))
                        goto tx_err;
 
                xfrm_decode_session(skb, &fl, AF_INET6);