Commit f88de8de5a8c8a8a73960d4432ceef2d38b7f86f

Authored by Changli Gao
Committed by David S. Miller
1 parent 38cfb907a5

net: bridge: check the length of skb after nf_bridge_maybe_copy_header()

Since nf_bridge_maybe_copy_header() may change the length of skb,
we should check the length of skb after it to handle the ppoe skbs.

Signed-off-by: Changli Gao <xiaosuo@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Showing 1 changed file with 6 additions and 10 deletions Side-by-side Diff

net/bridge/br_forward.c
... ... @@ -41,17 +41,13 @@
41 41  
42 42 int br_dev_queue_push_xmit(struct sk_buff *skb)
43 43 {
44   - /* drop mtu oversized packets except gso */
45   - if (packet_length(skb) > skb->dev->mtu && !skb_is_gso(skb))
  44 + /* ip_fragment doesn't copy the MAC header */
  45 + if (nf_bridge_maybe_copy_header(skb) ||
  46 + (packet_length(skb) > skb->dev->mtu && !skb_is_gso(skb))) {
46 47 kfree_skb(skb);
47   - else {
48   - /* ip_fragment doesn't copy the MAC header */
49   - if (nf_bridge_maybe_copy_header(skb))
50   - kfree_skb(skb);
51   - else {
52   - skb_push(skb, ETH_HLEN);
53   - dev_queue_xmit(skb);
54   - }
  48 + } else {
  49 + skb_push(skb, ETH_HLEN);
  50 + dev_queue_xmit(skb);
55 51 }
56 52  
57 53 return 0;