ipv6: Correct comparisons and calculations using skb->tail and skb-transport_header

This corrects an regression introduced by "net: Use 16bits for *_headers
fields of struct skbuff" when NET_SKBUFF_DATA_USES_OFFSET is not set. In
that case skb->tail will be a pointer whereas skb->transport_header
will be an offset from head. This is corrected by using wrappers that
ensure that comparisons and calculations are always made using pointers.

Signed-off-by: Simon Horman <horms@verge.net.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 5 insertions, 4 deletions

diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index a0962697a257..781dd3c99680 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -693,7 +693,7 @@ static void ndisc_recv_ns(struct sk_buff *skb)
         const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
         const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
         u8 *lladdr = NULL;
-        u32 ndoptlen = skb->tail - (skb->transport_header +
+        u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
                                     offsetof(struct nd_msg, opt));
         struct ndisc_options ndopts;
         struct net_device *dev = skb->dev;
@@ -853,7 +853,7 @@ static void ndisc_recv_na(struct sk_buff *skb)
         const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
         const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
         u8 *lladdr = NULL;
-        u32 ndoptlen = skb->tail - (skb->transport_header +
+        u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
                                     offsetof(struct nd_msg, opt));
         struct ndisc_options ndopts;
         struct net_device *dev = skb->dev;
@@ -1069,7 +1069,8 @@ static void ndisc_router_discovery(struct sk_buff *skb)
 
         __u8 * opt = (__u8 *)(ra_msg + 1);
 
-        optlen = (skb->tail - skb->transport_header) - sizeof(struct ra_msg);
+        optlen = (skb_tail_pointer(skb) - skb_transport_header(skb)) -
+                sizeof(struct ra_msg);
 
         if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
                 ND_PRINTK(2, warn, "RA: source address is not link-local\n");
@@ -1346,7 +1347,7 @@ static void ndisc_redirect_rcv(struct sk_buff *skb)
         u8 *hdr;
         struct ndisc_options ndopts;
         struct rd_msg *msg = (struct rd_msg *)skb_transport_header(skb);
-        u32 ndoptlen = skb->tail - (skb->transport_header +
+        u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
                                     offsetof(struct rd_msg, opt));
 
 #ifdef CONFIG_IPV6_NDISC_NODETYPE