diff options
| -rw-r--r-- | drivers/net/tun.c | 14 |
1 files changed, 10 insertions, 4 deletions
diff --git a/drivers/net/tun.c b/drivers/net/tun.c index c54f967e2c66..b0ab882c021e 100644 --- a/drivers/net/tun.c +++ b/drivers/net/tun.c @@ -1872,8 +1872,11 @@ drop: skb->dev = tun->dev; break; case IFF_TAP: - if (!frags) - skb->protocol = eth_type_trans(skb, tun->dev); + if (frags && !pskb_may_pull(skb, ETH_HLEN)) { + err = -ENOMEM; + goto drop; + } + skb->protocol = eth_type_trans(skb, tun->dev); break; } @@ -1930,9 +1933,12 @@ drop: } if (frags) { + u32 headlen; + /* Exercise flow dissector code path. */ - u32 headlen = eth_get_headlen(tun->dev, skb->data, - skb_headlen(skb)); + skb_push(skb, ETH_HLEN); + headlen = eth_get_headlen(tun->dev, skb->data, + skb_headlen(skb)); if (unlikely(headlen > skb_headlen(skb))) { this_cpu_inc(tun->pcpu_stats->rx_dropped); |