ipv6: fix headroom calculation in udp6_ufo_fragment
ipv6: fix headroom calculation in udp6_ufo_fragment

Commit 1e2bd517c108816220f262d7954b697af03b5f9c ("udp6: Fix udp
fragmentation for tunnel traffic.") changed the calculation if
there is enough space to include a fragment header in the skb from a
skb->mac_header dervived one to skb_headroom. Because we already peeled
off the skb to transport_header this is wrong. Change this back to check
if we have enough room before the mac_header.

This fixes a panic Saran Neti reported. He used the tbf scheduler which
skb_gso_segments the skb. The offsets get negative and we panic in memcpy
because the skb was erroneously not expanded at the head.

Reported-by: Saran Neti <67ccba997ac96585473bbd096f4b91bfc68d6d7e@telus.com>
Cc: Pravin B Shelar <95dcc1879f3489c0d5163907cdd946775296b2dd@nicira.com>
Signed-off-by: Hannes Frederic Sowa <331be22c6b63ca3e0a03d408c2d906b1b02cd5f2@stressinduktion.org>
Signed-off-by: David S. Miller <fe08d3c717adf2ae63592e4c9aec6e3e404d8e3e@davemloft.net>

KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs