net: bridge: fix stale eth hdr pointer in br_dev_xmit
authorNikolay Aleksandrov <nikolay@cumulusnetworks.com>
Mon, 24 Feb 2020 16:46:22 +0000 (18:46 +0200)
committerDavid S. Miller <davem@davemloft.net>
Mon, 24 Feb 2020 19:11:19 +0000 (11:11 -0800)
commit823d81b0fa2cd83a640734e74caee338b5d3c093
treeca6ce51db8e585d6cb80c1bfe3f1358f64cc5237
parente4686c2d08ea1a45c262af5269c2aa6b977b85e2
net: bridge: fix stale eth hdr pointer in br_dev_xmit

In br_dev_xmit() we perform vlan filtering in br_allowed_ingress() but
if the packet has the vlan header inside (e.g. bridge with disabled
tx-vlan-offload) then the vlan filtering code will use skb_vlan_untag()
to extract the vid before filtering which in turn calls pskb_may_pull()
and we may end up with a stale eth pointer. Moreover the cached eth header
pointer will generally be wrong after that operation. Remove the eth header
caching and just use eth_hdr() directly, the compiler does the right thing
and calculates it only once so we don't lose anything.

Fixes: 057658cb33fb ("bridge: suppress arp pkts on BR_NEIGH_SUPPRESS ports")
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/bridge/br_device.c