1 files changed, 15 insertions, 12 deletions

diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 0f9b3a31997b..f5fba051df3d 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -393,7 +393,8 @@ out:
         int code = skb->h.icmph->code;
         int rel_type = 0;
         int rel_code = 0;
-        int rel_info = 0;
+        __be32 rel_info = 0;
+        __u32 n = 0;
         u16 flags;
         int grehlen = (iph->ihl<<2) + 4;
         struct sk_buff *skb2;
@@ -422,14 +423,16 @@ out:
         default:
                 return;
         case ICMP_PARAMETERPROB:
-                if (skb->h.icmph->un.gateway < (iph->ihl<<2))
+                n = ntohl(skb->h.icmph->un.gateway) >> 24;
+                if (n < (iph->ihl<<2))
                         return;
 
                 /* So... This guy found something strange INSIDE encapsulated
                    packet. Well, he is fool, but what can we do ?
                  */
                 rel_type = ICMP_PARAMETERPROB;
-                rel_info = skb->h.icmph->un.gateway - grehlen;
+                n -= grehlen;
+                rel_info = htonl(n << 24);
                 break;
 
         case ICMP_DEST_UNREACH:
@@ -440,13 +443,14 @@ out:
                         return;
                 case ICMP_FRAG_NEEDED:
                         /* And it is the only really necessary thing :-) */
-                        rel_info = ntohs(skb->h.icmph->un.frag.mtu);
-                        if (rel_info < grehlen+68)
+                        n = ntohs(skb->h.icmph->un.frag.mtu);
+                        if (n < grehlen+68)
                                 return;
-                        rel_info -= grehlen;
+                        n -= grehlen;
                         /* BSD 4.2 MORE DOES NOT EXIST IN NATURE. */
-                        if (rel_info > ntohs(eiph->tot_len))
+                        if (n > ntohs(eiph->tot_len))
                                 return;
+                        rel_info = htonl(n);
                         break;
                 default:
                         /* All others are translated to HOST_UNREACH.
@@ -508,12 +512,11 @@ out:
 
         /* change mtu on this route */
         if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) {
-                if (rel_info > dst_mtu(skb2->dst)) {
+                if (n > dst_mtu(skb2->dst)) {
                         kfree_skb(skb2);
                         return;
                 }
-                skb2->dst->ops->update_pmtu(skb2->dst, rel_info);
-                rel_info = htonl(rel_info);
+                skb2->dst->ops->update_pmtu(skb2->dst, n);
         } else if (type == ICMP_TIME_EXCEEDED) {
                 struct ip_tunnel *t = netdev_priv(skb2->dev);
                 if (t->parms.iph.ttl) {
@@ -576,7 +579,7 @@ static int ipgre_rcv(struct sk_buff *skb)
 
                 if (flags&GRE_CSUM) {
                         switch (skb->ip_summed) {
-                        case CHECKSUM_HW:
+                        case CHECKSUM_COMPLETE:
                                 csum = (u16)csum_fold(skb->csum);
                                 if (!csum)
                                         break;
@@ -584,7 +587,7 @@ static int ipgre_rcv(struct sk_buff *skb)
                         case CHECKSUM_NONE:
                                 skb->csum = 0;
                                 csum = __skb_checksum_complete(skb);
-                                skb->ip_summed = CHECKSUM_HW;
+                                skb->ip_summed = CHECKSUM_COMPLETE;
                         }
                         offset += 4;
                 }