Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6: (27 commits)
  [Bluetooth] Add RFCOMM role switch support
  [Bluetooth] Allow disabling of credit based flow control
  [Bluetooth] Small cleanup of the L2CAP source code
  [Bluetooth] Use real devices for host controllers
  [Bluetooth] Add platform device for virtual and serial devices
  [Bluetooth] Add automatic sniff mode support
  [Bluetooth] Correct SCO buffer size on request
  [Bluetooth] Add suspend/resume support to the HCI USB driver
  [Bluetooth] Use raw mode for the Frontline sniffer device
  [BRIDGE]: br_dump_ifinfo index fix
  [ATM]: add+use poison defines
  [NET]: add+use poison defines
  [IOAT]: fix kernel-doc in source files
  [IOAT]: fix header file kernel-doc
  [TG3]: Add ipv6 TSO feature
  [IPV6]: Fix ipv6 GSO payload length
  [TIPC] Fixed sk_buff panic caused by tipc_link_bundle_buf (REVISED)
  [NET]: Verify gso_type too in gso_segment
  [IPVS]: Add sysctl documentation
  [ROSE]: Try all routes when establishing a ROSE connections.
  ...

1 files changed, 12 insertions, 1 deletions

diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 804458712d88..f6a2d9223d07 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2170,8 +2170,19 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb, int features)
 
         if (skb_gso_ok(skb, features | NETIF_F_GSO_ROBUST)) {
                 /* Packet is from an untrusted source, reset gso_segs. */
-                int mss = skb_shinfo(skb)->gso_size;
+                int type = skb_shinfo(skb)->gso_type;
+                int mss;
+
+                if (unlikely(type &
+                             ~(SKB_GSO_TCPV4 |
+                               SKB_GSO_DODGY |
+                               SKB_GSO_TCP_ECN |
+                               SKB_GSO_TCPV6 |
+                               0) ||
+                             !(type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6))))
+                        goto out;
 
+                mss = skb_shinfo(skb)->gso_size;
                 skb_shinfo(skb)->gso_segs = (skb->len + mss - 1) / mss;
 
                 segs = NULL;