Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 603a8bbe authored by Stephen Hemminger's avatar Stephen Hemminger Committed by David S. Miller
Browse files

skbuff: don't corrupt mac_header on skb expansion 



The skb mac_header field is sometimes NULL (or ~0u) as a sentinel
value. The places where skb is expanded add an offset which would
change this flag into an invalid pointer (or offset).

Signed-off-by: default avatarStephen Hemminger <shemminger@vyatta.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 19633e12

net/core/skbuff.c

+6 −3
Original line number Diff line number Diff line
@@ -661,6 +661,7 @@ static void copy_skb_header(struct sk_buff *new, const struct sk_buff *old) 
	/* {transport,network,mac}_header are relative to skb->head */

	new->transport_header += offset;

	new->network_header   += offset;

	if (skb_mac_header_was_set(new))

		new->mac_header	      += offset;

#endif

	skb_shinfo(new)->gso_size = skb_shinfo(old)->gso_size;
@@ -843,6 +844,7 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail, 
	skb->tail	      += off;

	skb->transport_header += off;

	skb->network_header   += off;

	if (skb_mac_header_was_set(skb))

		skb->mac_header += off;

	skb->csum_start       += nhead;

	skb->cloned   = 0;
@@ -935,6 +937,7 @@ struct sk_buff *skb_copy_expand(const struct sk_buff *skb, 
#ifdef NET_SKBUFF_DATA_USES_OFFSET

	n->transport_header += off;

	n->network_header   += off;

	if (skb_mac_header_was_set(skb))

		n->mac_header += off;

#endif