From: Willem de Bruijn Date: Thu, 24 May 2018 22:10:30 +0000 (-0400) Subject: packet: fix reserve calculation X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=0d751192afdef9f40746f36a47e802c35bc1075a;p=GitHub%2Fmoto-9609%2Fandroid_kernel_motorola_exynos9610.git packet: fix reserve calculation [ Upstream commit 9aad13b087ab0a588cd68259de618f100053360e ] Commit b84bbaf7a6c8 ("packet: in packet_snd start writing at link layer allocation") ensures that packet_snd always starts writing the link layer header in reserved headroom allocated for this purpose. This is needed because packets may be shorter than hard_header_len, in which case the space up to hard_header_len may be zeroed. But that necessary padding is not accounted for in skb->len. The fix, however, is buggy. It calls skb_push, which grows skb->len when moving skb->data back. But in this case packet length should not change. Instead, call skb_reserve, which moves both skb->data and skb->tail back, without changing length. Fixes: b84bbaf7a6c8 ("packet: in packet_snd start writing at link layer allocation") Reported-by: Tariq Toukan Signed-off-by: Willem de Bruijn Acked-by: Soheil Hassas Yeganeh Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c index 455f10328818..7806e166669a 100644 --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -2920,7 +2920,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) if (unlikely(offset < 0)) goto out_free; } else if (reserve) { - skb_push(skb, reserve); + skb_reserve(skb, -reserve); } /* Returns -EFAULT on error */