2 files changed, 30 insertions, 4 deletions

diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index e525a6cf558..6b150c072a4 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -110,6 +110,9 @@ struct tun_struct {
         struct tap_filter       txflt;
         struct socket           socket;
         struct socket_wq        wq;
+
+        int                     vnet_hdr_sz;
+
 #ifdef TUN_DEBUG
         int debug;
 #endif
@@ -563,7 +566,7 @@ static __inline__ ssize_t tun_get_user(struct tun_struct *tun,
         }
 
         if (tun->flags & TUN_VNET_HDR) {
-                if ((len -= sizeof(gso)) > count)
+                if ((len -= tun->vnet_hdr_sz) > count)
                         return -EINVAL;
 
                 if (memcpy_fromiovecend((void *)&gso, iv, offset, sizeof(gso)))
@@ -575,7 +578,7 @@ static __inline__ ssize_t tun_get_user(struct tun_struct *tun,
 
                 if (gso.hdr_len > len)
                         return -EINVAL;
-                offset += sizeof(gso);
+                offset += tun->vnet_hdr_sz;
         }
 
         if ((tun->flags & TUN_TYPE_MASK) == TUN_TAP_DEV) {
@@ -718,7 +721,7 @@ static __inline__ ssize_t tun_put_user(struct tun_struct *tun,
 
         if (tun->flags & TUN_VNET_HDR) {
                 struct virtio_net_hdr gso = { 0 }; /* no info leak */
-                if ((len -= sizeof(gso)) < 0)
+                if ((len -= tun->vnet_hdr_sz) < 0)
                         return -EINVAL;
 
                 if (skb_is_gso(skb)) {
@@ -749,7 +752,7 @@ static __inline__ ssize_t tun_put_user(struct tun_struct *tun,
                 if (unlikely(memcpy_toiovecend(iv, (void *)&gso, total,
                                                sizeof(gso))))
                         return -EFAULT;
-                total += sizeof(gso);
+                total += tun->vnet_hdr_sz;
         }
 
         len = min_t(int, skb->len, len);
@@ -1035,6 +1038,7 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
                 tun->dev = dev;
                 tun->flags = flags;
                 tun->txflt.count = 0;
+                tun->vnet_hdr_sz = sizeof(struct virtio_net_hdr);
 
                 err = -ENOMEM;
                 sk = sk_alloc(net, AF_UNSPEC, GFP_KERNEL, &tun_proto);
@@ -1177,6 +1181,7 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
         struct sock_fprog fprog;
         struct ifreq ifr;
         int sndbuf;
+        int vnet_hdr_sz;
         int ret;
 
         if (cmd == TUNSETIFF || _IOC_TYPE(cmd) == 0x89)
@@ -1322,6 +1327,25 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
                 tun->socket.sk->sk_sndbuf = sndbuf;
                 break;
 
+        case TUNGETVNETHDRSZ:
+                vnet_hdr_sz = tun->vnet_hdr_sz;
+                if (copy_to_user(argp, &vnet_hdr_sz, sizeof(vnet_hdr_sz)))
+                        ret = -EFAULT;
+                break;
+
+        case TUNSETVNETHDRSZ:
+                if (copy_from_user(&vnet_hdr_sz, argp, sizeof(vnet_hdr_sz))) {
+                        ret = -EFAULT;
+                        break;
+                }
+                if (vnet_hdr_sz < (int)sizeof(struct virtio_net_hdr)) {
+                        ret = -EINVAL;
+                        break;
+                }
+
+                tun->vnet_hdr_sz = vnet_hdr_sz;
+                break;
+
         case TUNATTACHFILTER:
                 /* Can be set only for TAPs */
                 ret = -EINVAL;
diff --git a/include/linux/if_tun.h b/include/linux/if_tun.h
index 1350a246893..06b1829731f 100644
--- a/include/linux/if_tun.h
+++ b/include/linux/if_tun.h
@@ -51,6 +51,8 @@
 #define TUNSETSNDBUF   _IOW('T', 212, int)
 #define TUNATTACHFILTER _IOW('T', 213, struct sock_fprog)
 #define TUNDETACHFILTER _IOW('T', 214, struct sock_fprog)
+#define TUNGETVNETHDRSZ _IOR('T', 215, int)
+#define TUNSETVNETHDRSZ _IOW('T', 216, int)
 
 /* TUNSETIFF ifr flags */
 #define IFF_TUN         0x0001