2 files changed, 51 insertions, 8 deletions

diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
index 1c4110df343e..a8a94e2f6ddc 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -38,6 +38,7 @@ struct macvtap_queue {
         struct sock sk;
         struct socket sock;
         struct socket_wq wq;
+        int vnet_hdr_sz;
         struct macvlan_dev *vlan;
         struct file *file;
         unsigned int flags;
@@ -285,6 +286,7 @@ static int macvtap_open(struct inode *inode, struct file *file)
         sock_init_data(&q->sock, &q->sk);
         q->sk.sk_write_space = macvtap_sock_write_space;
         q->flags = IFF_VNET_HDR | IFF_NO_PI | IFF_TAP;
+        q->vnet_hdr_sz = sizeof(struct virtio_net_hdr);
 
         err = macvtap_set_queue(dev, file, q);
         if (err)
@@ -445,14 +447,14 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q,
         int vnet_hdr_len = 0;
 
         if (q->flags & IFF_VNET_HDR) {
-                vnet_hdr_len = sizeof(vnet_hdr);
+                vnet_hdr_len = q->vnet_hdr_sz;
 
                 err = -EINVAL;
                 if ((len -= vnet_hdr_len) < 0)
                         goto err;
 
                 err = memcpy_fromiovecend((void *)&vnet_hdr, iv, 0,
-                                           vnet_hdr_len);
+                                           sizeof(vnet_hdr));
                 if (err < 0)
                         goto err;
                 if ((vnet_hdr.flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) &&
@@ -534,7 +536,7 @@ static ssize_t macvtap_put_user(struct macvtap_queue *q,
 
         if (q->flags & IFF_VNET_HDR) {
                 struct virtio_net_hdr vnet_hdr;
-                vnet_hdr_len = sizeof (vnet_hdr);
+                vnet_hdr_len = q->vnet_hdr_sz;
                 if ((len -= vnet_hdr_len) < 0)
                         return -EINVAL;
 
@@ -542,7 +544,7 @@ static ssize_t macvtap_put_user(struct macvtap_queue *q,
                 if (ret)
                         return ret;
 
-                if (memcpy_toiovecend(iv, (void *)&vnet_hdr, 0, vnet_hdr_len))
+                if (memcpy_toiovecend(iv, (void *)&vnet_hdr, 0, sizeof(vnet_hdr)))
                         return -EFAULT;
         }
 
@@ -627,6 +629,8 @@ static long macvtap_ioctl(struct file *file, unsigned int cmd,
         struct ifreq __user *ifr = argp;
         unsigned int __user *up = argp;
         unsigned int u;
+        int __user *sp = argp;
+        int s;
         int ret;
 
         switch (cmd) {
@@ -672,6 +676,21 @@ static long macvtap_ioctl(struct file *file, unsigned int cmd,
                 q->sk.sk_sndbuf = u;
                 return 0;
 
+        case TUNGETVNETHDRSZ:
+                s = q->vnet_hdr_sz;
+                if (put_user(s, sp))
+                        return -EFAULT;
+                return 0;
+
+        case TUNSETVNETHDRSZ:
+                if (get_user(s, sp))
+                        return -EFAULT;
+                if (s < (int)sizeof(struct virtio_net_hdr))
+                        return -EINVAL;
+
+                q->vnet_hdr_sz = s;
+                return 0;
+
         case TUNSETOFFLOAD:
                 /* let the user check for future flags */
                 if (arg & ~(TUN_F_CSUM | TUN_F_TSO4 | TUN_F_TSO6 |
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index e525a6cf5587..6b150c072a41 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -110,6 +110,9 @@ struct tun_struct {
         struct tap_filter       txflt;
         struct socket           socket;
         struct socket_wq        wq;
+
+        int                     vnet_hdr_sz;
+
 #ifdef TUN_DEBUG
         int debug;
 #endif
@@ -563,7 +566,7 @@ static __inline__ ssize_t tun_get_user(struct tun_struct *tun,
         }
 
         if (tun->flags & TUN_VNET_HDR) {
-                if ((len -= sizeof(gso)) > count)
+                if ((len -= tun->vnet_hdr_sz) > count)
                         return -EINVAL;
 
                 if (memcpy_fromiovecend((void *)&gso, iv, offset, sizeof(gso)))
@@ -575,7 +578,7 @@ static __inline__ ssize_t tun_get_user(struct tun_struct *tun,
 
                 if (gso.hdr_len > len)
                         return -EINVAL;
-                offset += sizeof(gso);
+                offset += tun->vnet_hdr_sz;
         }
 
         if ((tun->flags & TUN_TYPE_MASK) == TUN_TAP_DEV) {
@@ -718,7 +721,7 @@ static __inline__ ssize_t tun_put_user(struct tun_struct *tun,
 
         if (tun->flags & TUN_VNET_HDR) {
                 struct virtio_net_hdr gso = { 0 }; /* no info leak */
-                if ((len -= sizeof(gso)) < 0)
+                if ((len -= tun->vnet_hdr_sz) < 0)
                         return -EINVAL;
 
                 if (skb_is_gso(skb)) {
@@ -749,7 +752,7 @@ static __inline__ ssize_t tun_put_user(struct tun_struct *tun,
                 if (unlikely(memcpy_toiovecend(iv, (void *)&gso, total,
                                                sizeof(gso))))
                         return -EFAULT;
-                total += sizeof(gso);
+                total += tun->vnet_hdr_sz;
         }
 
         len = min_t(int, skb->len, len);
@@ -1035,6 +1038,7 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
                 tun->dev = dev;
                 tun->flags = flags;
                 tun->txflt.count = 0;
+                tun->vnet_hdr_sz = sizeof(struct virtio_net_hdr);
 
                 err = -ENOMEM;
                 sk = sk_alloc(net, AF_UNSPEC, GFP_KERNEL, &tun_proto);
@@ -1177,6 +1181,7 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
         struct sock_fprog fprog;
         struct ifreq ifr;
         int sndbuf;
+        int vnet_hdr_sz;
         int ret;
 
         if (cmd == TUNSETIFF || _IOC_TYPE(cmd) == 0x89)
@@ -1322,6 +1327,25 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
                 tun->socket.sk->sk_sndbuf = sndbuf;
                 break;
 
+        case TUNGETVNETHDRSZ:
+                vnet_hdr_sz = tun->vnet_hdr_sz;
+                if (copy_to_user(argp, &vnet_hdr_sz, sizeof(vnet_hdr_sz)))
+                        ret = -EFAULT;
+                break;
+
+        case TUNSETVNETHDRSZ:
+                if (copy_from_user(&vnet_hdr_sz, argp, sizeof(vnet_hdr_sz))) {
+                        ret = -EFAULT;
+                        break;
+                }
+                if (vnet_hdr_sz < (int)sizeof(struct virtio_net_hdr)) {
+                        ret = -EINVAL;
+                        break;
+                }
+
+                tun->vnet_hdr_sz = vnet_hdr_sz;
+                break;
+
         case TUNATTACHFILTER:
                 /* Can be set only for TAPs */
                 ret = -EINVAL;