queue-4.4/packet-reset-network-header-if-packet-shorter-than-ll-reserved-space.patch

   1 From foo@baz Wed Aug 22 10:28:26 CEST 2018
   2 From: Willem de Bruijn <willemb@google.com>
   3 Date: Wed, 11 Jul 2018 12:00:45 -0400
   4 Subject: packet: reset network header if packet shorter than ll reserved space
   5
   6 From: Willem de Bruijn <willemb@google.com>
   7
   8 [ Upstream commit 993675a3100b16a4c80dfd70cbcde8ea7127b31d ]
   9
  10 If variable length link layer headers result in a packet shorter
  11 than dev->hard_header_len, reset the network header offset. Else
  12 skb->mac_len may exceed skb->len after skb_mac_reset_len.
  13
  14 packet_sendmsg_spkt already has similar logic.
  15
  16 Fixes: b84bbaf7a6c8 ("packet: in packet_snd start writing at link layer allocation")
  17 Signed-off-by: Willem de Bruijn <willemb@google.com>
  18 Signed-off-by: David S. Miller <davem@davemloft.net>
  19 Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
  20 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  21 ---
  22  net/packet/af_packet.c |    2 ++
  23  1 file changed, 2 insertions(+)
  24
  25 --- a/net/packet/af_packet.c
  26 +++ b/net/packet/af_packet.c
  27 @@ -2780,6 +2780,8 @@ static int packet_snd(struct socket *soc
  28                         goto out_free;
  29         } else if (reserve) {
  30                 skb_reserve(skb, -reserve);
  31 +               if (len < reserve)
  32 +                       skb_reset_network_header(skb);
  33         }
  34
  35         /* Returns -EFAULT on error */