From: Changli Gao <xiaosuo@gmail.com>
Date: Sat, 25 Dec 2010 03:41:30 +0000 (+0000)
Subject: net: bridge: check the length of skb after nf_bridge_maybe_copy_header()
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=f88de8de5a8c8a8a73960d4432ceef2d38b7f86f;p=GitHub%2FLineageOS%2Fandroid_kernel_motorola_exynos9610.git

net: bridge: check the length of skb after nf_bridge_maybe_copy_header()

Since nf_bridge_maybe_copy_header() may change the length of skb,
we should check the length of skb after it to handle the ppoe skbs.

Signed-off-by: Changli Gao <xiaosuo@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
---

diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index 2bd11ec6d166..ee64287f1290 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -41,17 +41,13 @@ static inline unsigned packet_length(const struct sk_buff *skb)
 
 int br_dev_queue_push_xmit(struct sk_buff *skb)
 {
-	/* drop mtu oversized packets except gso */
-	if (packet_length(skb) > skb->dev->mtu && !skb_is_gso(skb))
+	/* ip_fragment doesn't copy the MAC header */
+	if (nf_bridge_maybe_copy_header(skb) ||
+	    (packet_length(skb) > skb->dev->mtu && !skb_is_gso(skb))) {
 		kfree_skb(skb);
-	else {
-		/* ip_fragment doesn't copy the MAC header */
-		if (nf_bridge_maybe_copy_header(skb))
-			kfree_skb(skb);
-		else {
-			skb_push(skb, ETH_HLEN);
-			dev_queue_xmit(skb);
-		}
+	} else {
+		skb_push(skb, ETH_HLEN);
+		dev_queue_xmit(skb);
 	}
 
 	return 0;