ipv6: fix overlap check for fragments

The type of FRAG6_CB(prev)->offset is int, skb->len is *unsigned* int, and offset is int.

Without this patch, type conversion occurred to this expression, when (FRAG6_CB(prev)->offset + prev->len) is less than offset.

---
 net/ipv6/reassembly.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

index c7ba314..0f27664 100644
@@ -349,7 +349,7 @@ found:
 
 	/* Check for overlap with preceding fragment. */
 	if (prev &&
-	    (FRAG6_CB(prev)->offset + prev->len) - offset > 0)
+	    (FRAG6_CB(prev)->offset + prev->len) > offset)
 		goto discard_fq;
 
 	/* Look for overlap with succeeding segment. */

1.6.3.3

From: Shan Wei <[email protected]>
Date: Fri, 05 Nov 2010 19:56:34 +0800

Applied.