Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (59 commits)
  igbvf.txt: Add igbvf Documentation
  igb.txt: Add igb documentation
  e100/e1000*/igb*/ixgb*: Add missing read memory barrier
  ixgbe: fix build error with FCOE_CONFIG without DCB_CONFIG
  netxen: protect tx timeout recovery by rtnl lock
  isdn: gigaset: use after free
  isdn: gigaset: add missing unlock
  solos-pci: Fix race condition in tasklet RX handling
  pkt_sched: Fix sch_sfq vs tcf_bind_filter oops
  net: disable preemption before call smp_processor_id()
  tcp: no md5sig option size check bug
  iwlwifi: fix locking assertions
  iwlwifi: fix TX tracer
  isdn: fix information leak
  net: Fix napi_gro_frags vs netpoll path
  usbnet: remove noisy and hardly useful printk
  rtl8180: avoid potential NULL deref in rtl8180_beacon_work
  ath9k: Remove myself from the MAINTAINERS list
  libertas: scan before assocation if no BSSID was given
  libertas: fix association with some APs by using extended rates
  ...

1 files changed, 10 insertions, 2 deletions

diff --git a/net/sched/cls_rsvp.h b/net/sched/cls_rsvp.h
index dd9414e4420..425a1790b04 100644
--- a/net/sched/cls_rsvp.h
+++ b/net/sched/cls_rsvp.h
@@ -143,9 +143,17 @@ static int rsvp_classify(struct sk_buff *skb, struct tcf_proto *tp,
         u8 tunnelid = 0;
         u8 *xprt;
 #if RSVP_DST_LEN == 4
-        struct ipv6hdr *nhptr = ipv6_hdr(skb);
+        struct ipv6hdr *nhptr;
+
+        if (!pskb_network_may_pull(skb, sizeof(*nhptr)))
+                return -1;
+        nhptr = ipv6_hdr(skb);
 #else
-        struct iphdr *nhptr = ip_hdr(skb);
+        struct iphdr *nhptr;
+
+        if (!pskb_network_may_pull(skb, sizeof(*nhptr)))
+                return -1;
+        nhptr = ip_hdr(skb);
 #endif
 
 restart: