1 files changed, 39 insertions, 25 deletions

diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 075f540ec197..6603511e3673 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -75,6 +75,9 @@ static void	tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
                                       struct request_sock *req);
 
 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
+static void     __tcp_v6_send_check(struct sk_buff *skb,
+                                    struct in6_addr *saddr,
+                                    struct in6_addr *daddr);
 
 static const struct inet_connection_sock_af_ops ipv6_mapped;
 static const struct inet_connection_sock_af_ops ipv6_specific;
@@ -350,6 +353,11 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         if (sk->sk_state == TCP_CLOSE)
                 goto out;
 
+        if (ipv6_hdr(skb)->hop_limit < inet6_sk(sk)->min_hopcount) {
+                NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
+                goto out;
+        }
+
         tp = tcp_sk(sk);
         seq = ntohl(th->seq);
         if (sk->sk_state != TCP_LISTEN &&
@@ -503,14 +511,10 @@ static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req,
 
         skb = tcp_make_synack(sk, dst, req, rvp);
         if (skb) {
-                struct tcphdr *th = tcp_hdr(skb);
-
-                th->check = tcp_v6_check(skb->len,
-                                         &treq->loc_addr, &treq->rmt_addr,
-                                         csum_partial(th, skb->len, skb->csum));
+                __tcp_v6_send_check(skb, &treq->loc_addr, &treq->rmt_addr);
 
                 ipv6_addr_copy(&fl.fl6_dst, &treq->rmt_addr);
-                err = ip6_xmit(sk, skb, &fl, opt, 0);
+                err = ip6_xmit(sk, skb, &fl, opt);
                 err = net_xmit_eval(err);
         }
 
@@ -918,22 +922,29 @@ static struct timewait_sock_ops tcp6_timewait_sock_ops = {
         .twsk_destructor= tcp_twsk_destructor,
 };
 
-static void tcp_v6_send_check(struct sock *sk, int len, struct sk_buff *skb)
+static void __tcp_v6_send_check(struct sk_buff *skb,
+                                struct in6_addr *saddr, struct in6_addr *daddr)
 {
-        struct ipv6_pinfo *np = inet6_sk(sk);
         struct tcphdr *th = tcp_hdr(skb);
 
         if (skb->ip_summed == CHECKSUM_PARTIAL) {
-                th->check = ~csum_ipv6_magic(&np->saddr, &np->daddr, len, IPPROTO_TCP,  0);
+                th->check = ~tcp_v6_check(skb->len, saddr, daddr, 0);
                 skb->csum_start = skb_transport_header(skb) - skb->head;
                 skb->csum_offset = offsetof(struct tcphdr, check);
         } else {
-                th->check = csum_ipv6_magic(&np->saddr, &np->daddr, len, IPPROTO_TCP,
-                                            csum_partial(th, th->doff<<2,
-                                                         skb->csum));
+                th->check = tcp_v6_check(skb->len, saddr, daddr,
+                                         csum_partial(th, th->doff << 2,
+                                                      skb->csum));
         }
 }
 
+static void tcp_v6_send_check(struct sock *sk, struct sk_buff *skb)
+{
+        struct ipv6_pinfo *np = inet6_sk(sk);
+
+        __tcp_v6_send_check(skb, &np->saddr, &np->daddr);
+}
+
 static int tcp_v6_gso_send_check(struct sk_buff *skb)
 {
         struct ipv6hdr *ipv6h;
@@ -946,11 +957,8 @@ static int tcp_v6_gso_send_check(struct sk_buff *skb)
         th = tcp_hdr(skb);
 
         th->check = 0;
-        th->check = ~csum_ipv6_magic(&ipv6h->saddr, &ipv6h->daddr, skb->len,
-                                     IPPROTO_TCP, 0);
-        skb->csum_start = skb_transport_header(skb) - skb->head;
-        skb->csum_offset = offsetof(struct tcphdr, check);
         skb->ip_summed = CHECKSUM_PARTIAL;
+        __tcp_v6_send_check(skb, &ipv6h->saddr, &ipv6h->daddr);
         return 0;
 }
 
@@ -1047,15 +1055,14 @@ static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
         }
 #endif
 
-        buff->csum = csum_partial(t1, tot_len, 0);
-
         memset(&fl, 0, sizeof(fl));
         ipv6_addr_copy(&fl.fl6_dst, &ipv6_hdr(skb)->saddr);
         ipv6_addr_copy(&fl.fl6_src, &ipv6_hdr(skb)->daddr);
 
-        t1->check = csum_ipv6_magic(&fl.fl6_src, &fl.fl6_dst,
-                                    tot_len, IPPROTO_TCP,
-                                    buff->csum);
+        buff->ip_summed = CHECKSUM_PARTIAL;
+        buff->csum = 0;
+
+        __tcp_v6_send_check(buff, &fl.fl6_src, &fl.fl6_dst);
 
         fl.proto = IPPROTO_TCP;
         fl.oif = inet6_iif(skb);
@@ -1070,7 +1077,7 @@ static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
         if (!ip6_dst_lookup(ctl_sk, &dst, &fl)) {
                 if (xfrm_lookup(net, &dst, &fl, NULL, 0) >= 0) {
                         skb_dst_set(buff, dst);
-                        ip6_xmit(ctl_sk, buff, &fl, NULL, 0);
+                        ip6_xmit(ctl_sk, buff, &fl, NULL);
                         TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
                         if (rst)
                                 TCP_INC_STATS_BH(net, TCP_MIB_OUTRSTS);
@@ -1233,12 +1240,12 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
                         goto drop_and_free;
 
                 /* Secret recipe starts with IP addresses */
-                d = &ipv6_hdr(skb)->daddr.s6_addr32[0];
+                d = (__force u32 *)&ipv6_hdr(skb)->daddr.s6_addr32[0];
                 *mess++ ^= *d++;
                 *mess++ ^= *d++;
                 *mess++ ^= *d++;
                 *mess++ ^= *d++;
-                d = &ipv6_hdr(skb)->saddr.s6_addr32[0];
+                d = (__force u32 *)&ipv6_hdr(skb)->saddr.s6_addr32[0];
                 *mess++ ^= *d++;
                 *mess++ ^= *d++;
                 *mess++ ^= *d++;
@@ -1676,6 +1683,7 @@ ipv6_pktoptions:
 static int tcp_v6_rcv(struct sk_buff *skb)
 {
         struct tcphdr *th;
+        struct ipv6hdr *hdr;
         struct sock *sk;
         int ret;
         struct net *net = dev_net(skb->dev);
@@ -1702,12 +1710,13 @@ static int tcp_v6_rcv(struct sk_buff *skb)
                 goto bad_packet;
 
         th = tcp_hdr(skb);
+        hdr = ipv6_hdr(skb);
         TCP_SKB_CB(skb)->seq = ntohl(th->seq);
         TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
                                     skb->len - th->doff*4);
         TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
         TCP_SKB_CB(skb)->when = 0;
-        TCP_SKB_CB(skb)->flags = ipv6_get_dsfield(ipv6_hdr(skb));
+        TCP_SKB_CB(skb)->flags = ipv6_get_dsfield(hdr);
         TCP_SKB_CB(skb)->sacked = 0;
 
         sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
@@ -1718,6 +1727,11 @@ process:
         if (sk->sk_state == TCP_TIME_WAIT)
                 goto do_time_wait;
 
+        if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
+                NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
+                goto discard_and_relse;
+        }
+
         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
                 goto discard_and_relse;