Commit 55eff0eb authored Aug 15, 2020 by Miaohe Lin Committed by David S. Miller Aug 16, 2020

net: Fix potential wrong skb->protocol in skb_vlan_untag()



We may access the two bytes after vlan_hdr in vlan_set_encap_proto(). So
we should pull VLAN_HLEN + sizeof(unsigned short) in skb_vlan_untag() or
we may access the wrong data.

Fixes: 0d5501c1 ("net: Always untag vlan-tagged traffic on input.")
Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent f8414a8d

net/core/skbuff.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -5418,8 +5418,8 @@ struct sk_buff skb_vlan_untag(struct sk_buff skb)
		skb = skb_share_check(skb, GFP_ATOMIC);
		if (unlikely(!skb))
		goto err_free;

		if (unlikely(!pskb_may_pull(skb, VLAN_HLEN)))
		/* We may access the two bytes after vlan_hdr in vlan_set_encap_proto(). */
		if (unlikely(!pskb_may_pull(skb, VLAN_HLEN + sizeof(unsigned short))))
		goto err_free;

		vhdr = (struct vlan_hdr *)skb->data;

Admin message