1 files changed, 27 insertions, 16 deletions

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 58900c21e4e4..e22339fad10b 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -571,7 +571,10 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
         int ptr, offset = 0, err = 0;
         u8 *prevhdr, nexthdr = 0;
 
-        hlen = ip6_find_1stfragopt(skb, &prevhdr);
+        err = ip6_find_1stfragopt(skb, &prevhdr);
+        if (err < 0)
+                goto fail;
+        hlen = err;
         nexthdr = *prevhdr;
 
         mtu = ip6_skb_dst_mtu(skb);
@@ -644,8 +647,6 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
                 *prevhdr = NEXTHDR_FRAGMENT;
                 tmp_hdr = kmemdup(skb_network_header(skb), hlen, GFP_ATOMIC);
                 if (!tmp_hdr) {
-                        IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
-                                      IPSTATS_MIB_FRAGFAILS);
                         err = -ENOMEM;
                         goto fail;
                 }
@@ -742,13 +743,14 @@ slow_path:
          *      Fragment the datagram.
          */
 
-        *prevhdr = NEXTHDR_FRAGMENT;
         troom = rt->dst.dev->needed_tailroom;
 
         /*
          *      Keep copying data until we run out.
          */
         while (left > 0)        {
+                u8 *fragnexthdr_offset;
+
                 len = left;
                 /* IF: it doesn't fit, use 'mtu' - the data space left */
                 if (len > mtu)
@@ -763,8 +765,6 @@ slow_path:
                 frag = alloc_skb(len + hlen + sizeof(struct frag_hdr) +
                                  hroom + troom, GFP_ATOMIC);
                 if (!frag) {
-                        IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
-                                      IPSTATS_MIB_FRAGFAILS);
                         err = -ENOMEM;
                         goto fail;
                 }
@@ -793,6 +793,10 @@ slow_path:
                  */
                 skb_copy_from_linear_data(skb, skb_network_header(frag), hlen);
 
+                fragnexthdr_offset = skb_network_header(frag);
+                fragnexthdr_offset += prevhdr - skb_network_header(skb);
+                *fragnexthdr_offset = NEXTHDR_FRAGMENT;
+
                 /*
                  *      Build fragment header.
                  */
@@ -996,6 +1000,11 @@ static int ip6_dst_lookup_tail(struct net *net, const struct sock *sk,
                 }
         }
 #endif
+        if (ipv6_addr_v4mapped(&fl6->saddr) &&
+            !(ipv6_addr_v4mapped(&fl6->daddr) || ipv6_addr_any(&fl6->daddr))) {
+                err = -EAFNOSUPPORT;
+                goto out_err_release;
+        }
 
         return 0;
 
@@ -1348,11 +1357,12 @@ emsgsize:
          */
 
         cork->length += length;
-        if (((length > mtu) ||
-             (skb && skb_is_gso(skb))) &&
+        if ((skb && skb_is_gso(skb)) ||
+            (((length + (skb ? skb->len : headersize)) > mtu) &&
+            (skb_queue_len(queue) <= 1) &&
             (sk->sk_protocol == IPPROTO_UDP) &&
             (rt->dst.dev->features & NETIF_F_UFO) &&
-            (sk->sk_type == SOCK_DGRAM) && !udp_get_no_check6_tx(sk)) {
+            (sk->sk_type == SOCK_DGRAM) && !udp_get_no_check6_tx(sk))) {
                 err = ip6_ufo_append_data(sk, queue, getfrag, from, length,
                                           hh_len, fragheaderlen, exthdrlen,
                                           transhdrlen, mtu, flags, fl6);
@@ -1424,6 +1434,11 @@ alloc_new_skb:
                          */
                         alloclen += sizeof(struct frag_hdr);
 
+                        copy = datalen - transhdrlen - fraggap;
+                        if (copy < 0) {
+                                err = -EINVAL;
+                                goto error;
+                        }
                         if (transhdrlen) {
                                 skb = sock_alloc_send_skb(sk,
                                                 alloclen + hh_len,
@@ -1473,13 +1488,9 @@ alloc_new_skb:
                                 data += fraggap;
                                 pskb_trim_unique(skb_prev, maxfraglen);
                         }
-                        copy = datalen - transhdrlen - fraggap;
-
-                        if (copy < 0) {
-                                err = -EINVAL;
-                                kfree_skb(skb);
-                                goto error;
-                        } else if (copy > 0 && getfrag(from, data + transhdrlen, offset, copy, fraggap, skb) < 0) {
+                        if (copy > 0 &&
+                            getfrag(from, data + transhdrlen, offset,
+                                    copy, fraggap, skb) < 0) {
                                 err = -EFAULT;
                                 kfree_skb(skb);
                                 goto error;