arp: do not assume dev_hard_header() does not change skb->head

[ Upstream commit c92510f5e3f82ba11c95991824a41e59a9c5ed81 ]

arp_create() is the only dev_hard_header() caller
making assumption about skb->head being unchanged.

A recent commit broke this assumption.

Initialize @arp pointer after dev_hard_header() call.

Fixes: db5b4e39c4e6 ("ip6_gre: make ip6gre_header() robust")
Reported-by: syzbot+58b44a770a1585795351@syzkaller.appspotmail.com
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260107212250.384552-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index 50e2b4939d8e90088b8923a445ae208bfceb8847..fc8c7a34b53e6ccd0964f29d9b96f81905f6fdfa 100644 (file)
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -563,7 +563,7 @@ struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip,
 
        skb_reserve(skb, hlen);
        skb_reset_network_header(skb);
-       arp = skb_put(skb, arp_hdr_len(dev));
+       skb_put(skb, arp_hdr_len(dev));
        skb->dev = dev;
        skb->protocol = htons(ETH_P_ARP);
        if (!src_hw)
@@ -571,12 +571,13 @@ struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip,
        if (!dest_hw)
                dest_hw = dev->broadcast;
 
-       /*
-        *      Fill the device header for the ARP frame
+       /* Fill the device header for the ARP frame.
+        * Note: skb->head can be changed.
         */
        if (dev_hard_header(skb, dev, ptype, dest_hw, src_hw, skb->len) < 0)
                goto out;
 
+       arp = arp_hdr(skb);
        /*
         * Fill out the arp protocol part.
         *