1 files changed, 27 insertions, 29 deletions

diff --git a/net/ipv6/mip6.c b/net/ipv6/mip6.c
index 0f9bdc5ee9f..43242e6e610 100644
--- a/net/ipv6/mip6.c
+++ b/net/ipv6/mip6.c
@@ -22,8 +22,6 @@
  *      Masahide NAKAMURA @USAGI
  */
 
-#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-
 #include <linux/module.h>
 #include <linux/skbuff.h>
 #include <linux/time.h>
@@ -46,7 +44,7 @@ static inline void *mip6_padn(__u8 *data, __u8 padlen)
         if (!data)
                 return NULL;
         if (padlen == 1) {
-                data[0] = IPV6_TLV_PAD1;
+                data[0] = IPV6_TLV_PAD0;
         } else if (padlen > 1) {
                 data[0] = IPV6_TLV_PADN;
                 data[1] = padlen - 2;
@@ -86,30 +84,28 @@ static int mip6_mh_len(int type)
 
 static int mip6_mh_filter(struct sock *sk, struct sk_buff *skb)
 {
-        struct ip6_mh _hdr;
-        const struct ip6_mh *mh;
+        struct ip6_mh *mh;
 
-        mh = skb_header_pointer(skb, skb_transport_offset(skb),
-                                sizeof(_hdr), &_hdr);
-        if (!mh)
+        if (!pskb_may_pull(skb, (skb_transport_offset(skb)) + 8) ||
+            !pskb_may_pull(skb, (skb_transport_offset(skb) +
+                                 ((skb_transport_header(skb)[1] + 1) << 3))))
                 return -1;
 
-        if (((mh->ip6mh_hdrlen + 1) << 3) > skb->len)
-                return -1;
+        mh = (struct ip6_mh *)skb_transport_header(skb);
 
         if (mh->ip6mh_hdrlen < mip6_mh_len(mh->ip6mh_type)) {
                 LIMIT_NETDEBUG(KERN_DEBUG "mip6: MH message too short: %d vs >=%d\n",
                                mh->ip6mh_hdrlen, mip6_mh_len(mh->ip6mh_type));
-                mip6_param_prob(skb, 0, offsetof(struct ip6_mh, ip6mh_hdrlen) +
-                                skb_network_header_len(skb));
+                mip6_param_prob(skb, 0, ((&mh->ip6mh_hdrlen) -
+                                         skb_network_header(skb)));
                 return -1;
         }
 
         if (mh->ip6mh_proto != IPPROTO_NONE) {
                 LIMIT_NETDEBUG(KERN_DEBUG "mip6: MH invalid payload proto = %d\n",
                                mh->ip6mh_proto);
-                mip6_param_prob(skb, 0, offsetof(struct ip6_mh, ip6mh_proto) +
-                                skb_network_header_len(skb));
+                mip6_param_prob(skb, 0, ((&mh->ip6mh_proto) -
+                                         skb_network_header(skb)));
                 return -1;
         }
 
@@ -199,8 +195,8 @@ static inline int mip6_report_rl_allow(struct timeval *stamp,
                 mip6_report_rl.stamp.tv_sec = stamp->tv_sec;
                 mip6_report_rl.stamp.tv_usec = stamp->tv_usec;
                 mip6_report_rl.iif = iif;
-                mip6_report_rl.src = *src;
-                mip6_report_rl.dst = *dst;
+                ipv6_addr_copy(&mip6_report_rl.src, src);
+                ipv6_addr_copy(&mip6_report_rl.dst, dst);
                 allow = 1;
         }
         spin_unlock_bh(&mip6_report_rl.lock);
@@ -311,12 +307,13 @@ static int mip6_destopt_offset(struct xfrm_state *x, struct sk_buff *skb,
 static int mip6_destopt_init_state(struct xfrm_state *x)
 {
         if (x->id.spi) {
-                pr_info("%s: spi is not 0: %u\n", __func__, x->id.spi);
+                printk(KERN_INFO "%s: spi is not 0: %u\n", __func__,
+                       x->id.spi);
                 return -EINVAL;
         }
         if (x->props.mode != XFRM_MODE_ROUTEOPTIMIZATION) {
-                pr_info("%s: state's mode is not %u: %u\n",
-                        __func__, XFRM_MODE_ROUTEOPTIMIZATION, x->props.mode);
+                printk(KERN_INFO "%s: state's mode is not %u: %u\n",
+                       __func__, XFRM_MODE_ROUTEOPTIMIZATION, x->props.mode);
                 return -EINVAL;
         }
 
@@ -446,12 +443,13 @@ static int mip6_rthdr_offset(struct xfrm_state *x, struct sk_buff *skb,
 static int mip6_rthdr_init_state(struct xfrm_state *x)
 {
         if (x->id.spi) {
-                pr_info("%s: spi is not 0: %u\n", __func__, x->id.spi);
+                printk(KERN_INFO "%s: spi is not 0: %u\n", __func__,
+                       x->id.spi);
                 return -EINVAL;
         }
         if (x->props.mode != XFRM_MODE_ROUTEOPTIMIZATION) {
-                pr_info("%s: state's mode is not %u: %u\n",
-                        __func__, XFRM_MODE_ROUTEOPTIMIZATION, x->props.mode);
+                printk(KERN_INFO "%s: state's mode is not %u: %u\n",
+                       __func__, XFRM_MODE_ROUTEOPTIMIZATION, x->props.mode);
                 return -EINVAL;
         }
 
@@ -483,18 +481,18 @@ static const struct xfrm_type mip6_rthdr_type =
 
 static int __init mip6_init(void)
 {
-        pr_info("Mobile IPv6\n");
+        printk(KERN_INFO "Mobile IPv6\n");
 
         if (xfrm_register_type(&mip6_destopt_type, AF_INET6) < 0) {
-                pr_info("%s: can't add xfrm type(destopt)\n", __func__);
+                printk(KERN_INFO "%s: can't add xfrm type(destopt)\n", __func__);
                 goto mip6_destopt_xfrm_fail;
         }
         if (xfrm_register_type(&mip6_rthdr_type, AF_INET6) < 0) {
-                pr_info("%s: can't add xfrm type(rthdr)\n", __func__);
+                printk(KERN_INFO "%s: can't add xfrm type(rthdr)\n", __func__);
                 goto mip6_rthdr_xfrm_fail;
         }
         if (rawv6_mh_filter_register(mip6_mh_filter) < 0) {
-                pr_info("%s: can't add rawv6 mh filter\n", __func__);
+                printk(KERN_INFO "%s: can't add rawv6 mh filter\n", __func__);
                 goto mip6_rawv6_mh_fail;
         }
 
@@ -512,11 +510,11 @@ static int __init mip6_init(void)
 static void __exit mip6_fini(void)
 {
         if (rawv6_mh_filter_unregister(mip6_mh_filter) < 0)
-                pr_info("%s: can't remove rawv6 mh filter\n", __func__);
+                printk(KERN_INFO "%s: can't remove rawv6 mh filter\n", __func__);
         if (xfrm_unregister_type(&mip6_rthdr_type, AF_INET6) < 0)
-                pr_info("%s: can't remove xfrm type(rthdr)\n", __func__);
+                printk(KERN_INFO "%s: can't remove xfrm type(rthdr)\n", __func__);
         if (xfrm_unregister_type(&mip6_destopt_type, AF_INET6) < 0)
-                pr_info("%s: can't remove xfrm type(destopt)\n", __func__);
+                printk(KERN_INFO "%s: can't remove xfrm type(destopt)\n", __func__);
 }
 
 module_init(mip6_init);