Merge branch 'erspan-a-couple-fixes'

William Tu says:

====================
net: erspan: a couple fixes

Haishuang Yan reports a couple of issues (wrong return value,
pskb_may_pull) on erspan V1.  Since erspan V2 is in net-next,
this series fix the similar issues on v2.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

2 files changed, 8 insertions, 4 deletions

diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 9a80d84fc182..fd4d6e96da7e 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -279,7 +279,6 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi,
          * Use ERSPAN 10-bit session ID as key.
          */
         tpi->key = cpu_to_be32(ntohs(ershdr->session_id) & ID_MASK);
-        pkt_md = (struct erspan_metadata *)(ershdr + 1);
         tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex,
                                   tpi->flags | TUNNEL_KEY,
                                   iph->saddr, iph->daddr, tpi->key);
@@ -287,7 +286,10 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi,
         if (tunnel) {
                 len = gre_hdr_len + erspan_hdr_len(ver);
                 if (unlikely(!pskb_may_pull(skb, len)))
-                        return -ENOMEM;
+                        return PACKET_REJECT;
+
+                ershdr = (struct erspan_base_hdr *)(skb->data + gre_hdr_len);
+                pkt_md = (struct erspan_metadata *)(ershdr + 1);
 
                 if (__iptunnel_pull_header(skb,
                                            len,
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 5c9c65f1d5c2..87b9892dfa23 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -515,7 +515,6 @@ static int ip6erspan_rcv(struct sk_buff *skb, int gre_hdr_len,
 
         ver = (ntohs(ershdr->ver_vlan) & VER_MASK) >> VER_OFFSET;
         tpi->key = cpu_to_be32(ntohs(ershdr->session_id) & ID_MASK);
-        pkt_md = (struct erspan_metadata *)(ershdr + 1);
 
         tunnel = ip6gre_tunnel_lookup(skb->dev,
                                       &ipv6h->saddr, &ipv6h->daddr, tpi->key,
@@ -524,7 +523,10 @@ static int ip6erspan_rcv(struct sk_buff *skb, int gre_hdr_len,
                 int len = erspan_hdr_len(ver);
 
                 if (unlikely(!pskb_may_pull(skb, len)))
-                        return -ENOMEM;
+                        return PACKET_REJECT;
+
+                ershdr = (struct erspan_base_hdr *)skb->data;
+                pkt_md = (struct erspan_metadata *)(ershdr + 1);
 
                 if (__iptunnel_pull_header(skb, len,
                                            htons(ETH_P_TEB),