A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-29 19:21:31 -04:00
Code Issues Projects Releases Packages Wiki Activity

net: Don't set transport offset to invalid value

Browse source 
If the socket was created with socket(AF_PACKET, SOCK_RAW, 0),
skb->protocol will be unset, __skb_flow_dissect() will fail, and
skb_probe_transport_header() will fall back to the offset_hint, making
the resulting skb_transport_offset incorrect.

If, however, there is no transport header in the packet,
transport_header shouldn't be set to an arbitrary value.

Fix it by leaving the transport offset unset if it couldn't be found, to
be explicit rather than to fill it with some wrong value. It changes the
behavior, but if some code relied on the old behavior, it would be
broken anyway, as the old one is incorrect.

Signed-off-by: Maxim Mikityanskiy <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
This commit is contained in:
Maxim Mikityanskiy 2019-02-21 12:39:57 +00:00 • committed by David S. Miller
commit d2aa125d62
6 changed files with 21 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

6
net/packet/af_packet.c
View file

@ -1970,7 +1970,7 @@ retry:
if (unlikely(extra_len == 4))
skb->no_fcs = 1;
skb_probe_transport_header(skb, 0);
skb_probe_transport_header(skb);
dev_queue_xmit(skb);
rcu_read_unlock();
@ -2519,7 +2519,7 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb,
len = ((to_write > len_max) ? len_max : to_write);
}
skb_probe_transport_header(skb, 0);
skb_probe_transport_header(skb);
return tp_len;
}
@ -2925,7 +2925,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
virtio_net_hdr_set_proto(skb, &vnet_hdr);
}
skb_probe_transport_header(skb, reserve);
skb_probe_transport_header(skb);
if (unlikely(extra_len == 4))
skb->no_fcs = 1;