Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0864c158 authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller
Browse files

net: eth_type_trans() should use skb_header_pointer() 



eth_type_trans() can read uninitialized memory as drivers
do not necessarily pull more than 14 bytes in skb->head before
calling it.

As David suggested, we can use skb_header_pointer() to
fix this without breaking some drivers that might not expect
eth_type_trans() pulling 2 additional bytes.

Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Cc: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 7967919d

net/ethernet/eth.c

+5 −2
Original line number Diff line number Diff line
@@ -156,7 +156,9 @@ EXPORT_SYMBOL(eth_rebuild_header); 
 */

__be16 eth_type_trans(struct sk_buff *skb, struct net_device *dev)

{

	struct ethhdr *eth;

	unsigned short _service_access_point;

	const unsigned short *sap;

	const struct ethhdr *eth;



	skb->dev = dev;

	skb_reset_mac_header(skb);
@@ -194,7 +196,8 @@ __be16 eth_type_trans(struct sk_buff *skb, struct net_device *dev) 
	 *      layer. We look for FFFF which isn't a used 802.2 SSAP/DSAP. This

	 *      won't work for fault tolerant netware but does for the rest.

	 */

	if (unlikely(skb->len >= 2 && *(unsigned short *)(skb->data) == 0xFFFF))

	sap = skb_header_pointer(skb, 0, sizeof(*sap), &_service_access_point);

	if (sap && *sap == 0xFFFF)

		return htons(ETH_P_802_3);



	/*