| >  * icmp_unreach() in net/ipv4/icmp.c already has this test:
| > 
| > 	/* Checkin full IP header plus 8 bytes of protocol to
| > 	 * avoid additional coding at protocol handlers.
| > 	 */
| >         if (!pskb_may_pull(skb, iph->ihl * 4 + 8))
| >                 goto out;
| 
| I just noticed that this won't bump the ICMP MIB counter.
| 
| The ICMP code will only bump the counter if the IP header isn't there,
| or has a bogus header length.
| 
| But it is clear in the callers that the intention is (or was) to bump
| the counter if the 8 bytes of post IP header bits are not there.
| 
If `goto out' is replaced with `goto out_err' in icmp_unreach(),
it may be worth considering the analogous case in icmpv6_notify():

	/* Checkin header including 8 bytes of inner protocol header. */
        if (!pskb_may_pull(skb, inner_offset+8))
                return;

and the `discard_it' jump label in icmpv6_rcv().