[TIPC] Fixed sk_buff panic caused by tipc_link_bundle_buf (REVISED)

[linux-2.6] / net / ipv4 / ip_options.c

diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
index d3f6c468faf43ac20e4a8e56e1d5325ca96f14e0..cbcae6544622932cbb7f0a57d648338bd699ceb9 100644 (file)
--- a/net/ipv4/ip_options.c
+++ b/net/ipv4/ip_options.c
@@ -11,6 +11,7 @@
  *             
  */
 
+#include <linux/capability.h>
 #include <linux/module.h>
 #include <linux/types.h>
 #include <asm/uaccess.h>
@@ -208,7 +209,7 @@ int ip_options_echo(struct ip_options * dopt, struct sk_buff * skb)
 
 void ip_options_fragment(struct sk_buff * skb) 
 {
-       unsigned char * optptr = skb->nh.raw;
+       unsigned char * optptr = skb->nh.raw + sizeof(struct iphdr);
        struct ip_options * opt = &(IPCB(skb)->opt);
        int  l = opt->optlen;
        int  optlen;