Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller:
 "A quick batch of bug fixes:

  1) Fix build with IPV6 disabled, from Eric Dumazet.

  2) Several more cases of caching SKB data pointers across calls to
     pskb_may_pull(), thus referencing potentially free'd memory.  From
     Li RongQing.

  3) DSA phy code tests operation presence improperly, instead of going:

        if (x->ops->foo)
                r = x->ops->foo(args);

     it was going:

        if (x->ops->foo(args))
                r = x->ops->foo(args);

   Fix from Andew Lunn"

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
  Net: DSA: Fix checking for get_phy_flags function
  ipv6: fix a potential use after free in sit.c
  ipv6: fix a potential use after free in ip6_offload.c
  ipv4: fix a potential use after free in gre_offload.c
  tcp: fix build error if IPv6 is not enabled

2 files changed, 4 insertions, 3 deletions

diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
index 9034f76ae013..91014d32488d 100644
--- a/net/ipv6/ip6_offload.c
+++ b/net/ipv6/ip6_offload.c
@@ -46,6 +46,7 @@ static int ipv6_gso_pull_exthdrs(struct sk_buff *skb, int proto)
                 if (unlikely(!pskb_may_pull(skb, len)))
                         break;
 
+                opth = (void *)skb->data;
                 proto = opth->nexthdr;
                 __skb_pull(skb, len);
         }
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 6eab37cf5345..58e5b4710127 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -485,11 +485,11 @@ static void ipip6_tunnel_uninit(struct net_device *dev)
  */
 static int ipip6_err_gen_icmpv6_unreach(struct sk_buff *skb)
 {
-        const struct iphdr *iph = (const struct iphdr *) skb->data;
+        int ihl = ((const struct iphdr *)skb->data)->ihl*4;
         struct rt6_info *rt;
         struct sk_buff *skb2;
 
-        if (!pskb_may_pull(skb, iph->ihl * 4 + sizeof(struct ipv6hdr) + 8))
+        if (!pskb_may_pull(skb, ihl + sizeof(struct ipv6hdr) + 8))
                 return 1;
 
         skb2 = skb_clone(skb, GFP_ATOMIC);
@@ -498,7 +498,7 @@ static int ipip6_err_gen_icmpv6_unreach(struct sk_buff *skb)
                 return 1;
 
         skb_dst_drop(skb2);
-        skb_pull(skb2, iph->ihl * 4);
+        skb_pull(skb2, ihl);
         skb_reset_network_header(skb2);
 
         rt = rt6_lookup(dev_net(skb->dev), &ipv6_hdr(skb2)->saddr, NULL, 0, 0);