diff options
-rw-r--r-- | net/ipv4/icmp.c | 3 | ||||
-rw-r--r-- | net/ipv4/igmp.c | 2 | ||||
-rw-r--r-- | net/ipv4/tcp.c | 3 |
3 files changed, 5 insertions, 3 deletions
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c index 562efd91f457..5d0d379b0152 100644 --- a/net/ipv4/icmp.c +++ b/net/ipv4/icmp.c | |||
@@ -503,7 +503,8 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info) | |||
503 | iph = ip_hdr(skb_in); | 503 | iph = ip_hdr(skb_in); |
504 | 504 | ||
505 | if ((u8 *)iph < skb_in->head || | 505 | if ((u8 *)iph < skb_in->head || |
506 | (skb_in->network_header + sizeof(*iph)) > skb_in->tail) | 506 | (skb_network_header(skb_in) + sizeof(*iph)) > |
507 | skb_tail_pointer(skb_in)) | ||
507 | goto out; | 508 | goto out; |
508 | 509 | ||
509 | /* | 510 | /* |
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c index d8c232794bcb..450f625361e4 100644 --- a/net/ipv4/igmp.c +++ b/net/ipv4/igmp.c | |||
@@ -363,7 +363,7 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, int size) | |||
363 | static int igmpv3_sendpack(struct sk_buff *skb) | 363 | static int igmpv3_sendpack(struct sk_buff *skb) |
364 | { | 364 | { |
365 | struct igmphdr *pig = igmp_hdr(skb); | 365 | struct igmphdr *pig = igmp_hdr(skb); |
366 | const int igmplen = skb->tail - skb->transport_header; | 366 | const int igmplen = skb_tail_pointer(skb) - skb_transport_header(skb); |
367 | 367 | ||
368 | pig->csum = ip_compute_csum(igmp_hdr(skb), igmplen); | 368 | pig->csum = ip_compute_csum(igmp_hdr(skb), igmplen); |
369 | 369 | ||
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index ba4186e1dca9..1f58594d5a85 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c | |||
@@ -2989,7 +2989,8 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb, | |||
2989 | swap(gso_skb->truesize, skb->truesize); | 2989 | swap(gso_skb->truesize, skb->truesize); |
2990 | } | 2990 | } |
2991 | 2991 | ||
2992 | delta = htonl(oldlen + (skb->tail - skb->transport_header) + | 2992 | delta = htonl(oldlen + (skb_tail_pointer(skb) - |
2993 | skb_transport_header(skb)) + | ||
2993 | skb->data_len); | 2994 | skb->data_len); |
2994 | th->check = ~csum_fold((__force __wsum)((__force u32)th->check + | 2995 | th->check = ~csum_fold((__force __wsum)((__force u32)th->check + |
2995 | (__force u32)delta)); | 2996 | (__force u32)delta)); |