ipv6: the entire IPv6 header chain must fit the first fragment

[mirror_ubuntu-bionic-kernel.git] / net / ipv6 / tcpv6_offload.c

diff --git a/net/ipv6/tcpv6_offload.c b/net/ipv6/tcpv6_offload.c
index d883c9204c01d525fcd51012c34afbf5f8af11ed..278e49cd67d4e2c7b0ab9138fabe84753d628b5a 100644 (file)
--- a/net/ipv6/tcpv6_offload.c
+++ b/net/ipv6/tcpv6_offload.c
@@ -46,6 +46,9 @@ static struct sk_buff *tcp6_gso_segment(struct sk_buff *skb,
 {
        struct tcphdr *th;
 
+       if (!(skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6))
+               return ERR_PTR(-EINVAL);
+
        if (!pskb_may_pull(skb, sizeof(*th)))
                return ERR_PTR(-EINVAL);