3 files changed, 15 insertions, 9 deletions

diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index 6b0e362cc99b..38d906baf1df 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -328,7 +328,7 @@ static int ip_tunnel_bind_dev(struct net_device *dev)
 
         if (tdev) {
                 hlen = tdev->hard_header_len + tdev->needed_headroom;
-                mtu = tdev->mtu;
+                mtu = min(tdev->mtu, IP_MAX_MTU);
         }
 
         dev->needed_headroom = t_hlen + hlen;
@@ -362,7 +362,7 @@ static struct ip_tunnel *ip_tunnel_create(struct net *net,
         nt = netdev_priv(dev);
         t_hlen = nt->hlen + sizeof(struct iphdr);
         dev->min_mtu = ETH_MIN_MTU;
-        dev->max_mtu = 0xFFF8 - dev->hard_header_len - t_hlen;
+        dev->max_mtu = IP_MAX_MTU - dev->hard_header_len - t_hlen;
         ip_tunnel_add(itn, nt);
         return nt;
 
@@ -930,7 +930,7 @@ int __ip_tunnel_change_mtu(struct net_device *dev, int new_mtu, bool strict)
 {
         struct ip_tunnel *tunnel = netdev_priv(dev);
         int t_hlen = tunnel->hlen + sizeof(struct iphdr);
-        int max_mtu = 0xFFF8 - dev->hard_header_len - t_hlen;
+        int max_mtu = IP_MAX_MTU - dev->hard_header_len - t_hlen;
 
         if (new_mtu < ETH_MIN_MTU)
                 return -EINVAL;
@@ -1107,7 +1107,7 @@ int ip_tunnel_newlink(struct net_device *dev, struct nlattr *tb[],
 
         mtu = ip_tunnel_bind_dev(dev);
         if (tb[IFLA_MTU]) {
-                unsigned int max = 0xfff8 - dev->hard_header_len - nt->hlen;
+                unsigned int max = IP_MAX_MTU - dev->hard_header_len - nt->hlen;
 
                 mtu = clamp(dev->mtu, (unsigned int)ETH_MIN_MTU,
                             (unsigned int)(max - sizeof(struct iphdr)));
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index da66aaac51ce..00e138a44cbb 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1692,8 +1692,13 @@ int ip6_tnl_change_mtu(struct net_device *dev, int new_mtu)
                 if (new_mtu < ETH_MIN_MTU)
                         return -EINVAL;
         }
-        if (new_mtu > 0xFFF8 - dev->hard_header_len)
-                return -EINVAL;
+        if (tnl->parms.proto == IPPROTO_IPV6 || tnl->parms.proto == 0) {
+                if (new_mtu > IP6_MAX_MTU - dev->hard_header_len)
+                        return -EINVAL;
+        } else {
+                if (new_mtu > IP_MAX_MTU - dev->hard_header_len)
+                        return -EINVAL;
+        }
         dev->mtu = new_mtu;
         return 0;
 }
@@ -1841,7 +1846,7 @@ ip6_tnl_dev_init_gen(struct net_device *dev)
         if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
                 dev->mtu -= 8;
         dev->min_mtu = ETH_MIN_MTU;
-        dev->max_mtu = 0xFFF8 - dev->hard_header_len;
+        dev->max_mtu = IP6_MAX_MTU - dev->hard_header_len;
 
         return 0;
 
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 2afce37a7177..e9400ffa7875 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -1371,7 +1371,7 @@ static void ipip6_tunnel_setup(struct net_device *dev)
         dev->hard_header_len    = LL_MAX_HEADER + t_hlen;
         dev->mtu                = ETH_DATA_LEN - t_hlen;
         dev->min_mtu            = IPV6_MIN_MTU;
-        dev->max_mtu            = 0xFFF8 - t_hlen;
+        dev->max_mtu            = IP6_MAX_MTU - t_hlen;
         dev->flags              = IFF_NOARP;
         netif_keep_dst(dev);
         dev->addr_len           = 4;
@@ -1583,7 +1583,8 @@ static int ipip6_newlink(struct net *src_net, struct net_device *dev,
         if (tb[IFLA_MTU]) {
                 u32 mtu = nla_get_u32(tb[IFLA_MTU]);
 
-                if (mtu >= IPV6_MIN_MTU && mtu <= 0xFFF8 - dev->hard_header_len)
+                if (mtu >= IPV6_MIN_MTU &&
+                    mtu <= IP6_MAX_MTU - dev->hard_header_len)
                         dev->mtu = mtu;
         }