net: Fix skb_under_panic oops in neigh_resolve_output (e1f16503) · Commits · 戴 / test

The retry loop in neigh_resolve_output() and neigh_connected_output() call dev_hard_header() with out reseting the skb to network_header. This causes the retry to fail with skb_under_panic. The fix is to reset the network_header within the retry loop. Signed-off-by:

Ramesh Nagappa <ramesh.nagappa@ericsson.com> Reviewed-by:

Shawn Lu <shawn.lu@ericsson.com> Reviewed-by:

Robert Coulson <robert.coulson@ericsson.com> Reviewed-by:

Billie Alsup <billie.alsup@ericsson.com> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/core/neighbour.c

+2 −4

Original line number	Diff line number	Diff line
		@@ -1301,8 +1301,6 @@ int neigh_resolve_output(struct neighbour neigh, struct sk_buff skb)
		if (!dst)
		goto discard;

		__skb_pull(skb, skb_network_offset(skb));

		if (!neigh_event_send(neigh, skb)) {
		int err;
		struct net_device *dev = neigh->dev;
		@@ -1312,6 +1310,7 @@ int neigh_resolve_output(struct neighbour neigh, struct sk_buff skb)
		neigh_hh_init(neigh, dst);

		do {
		__skb_pull(skb, skb_network_offset(skb));
		seq = read_seqbegin(&neigh->ha_lock);
		err = dev_hard_header(skb, dev, ntohs(skb->protocol),
		neigh->ha, NULL, skb->len);
		@@ -1342,9 +1341,8 @@ int neigh_connected_output(struct neighbour neigh, struct sk_buff skb)
		unsigned int seq;
		int err;

		__skb_pull(skb, skb_network_offset(skb));

		do {
		__skb_pull(skb, skb_network_offset(skb));
		seq = read_seqbegin(&neigh->ha_lock);
		err = dev_hard_header(skb, dev, ntohs(skb->protocol),
		neigh->ha, NULL, skb->len);

Admin message