Commit 952242db authored by Peiyang Wang's avatar Peiyang Wang Committed by Hao Chen
Browse files

net: hns3: don't add the len of vlan head if skb_vlan_pop failed 

driver inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/IAN3KC


CVE: NA

----------------------------------------------------------------------

skb_vlan_pop might return an error if pop vlan head failed. In that case,
the length of vlan head cannot be counted in tx_bytes.

Fixes: 0b68f477 ("net: hns3: support arp proxy")
Signed-off-by: default avatarPeiyang Wang <wangpeiyang1@huawei.com>
parent 9094b5aa

drivers/net/ethernet/hisilicon/hns3/hns3_roh.c

+9 −2
Original line number Diff line number Diff line
@@ -77,8 +77,10 @@ int hns3_handle_roh_arp_req(struct sk_buff *skb, struct hns3_nic_priv *priv) 
	if (skb_vlan_tagged(skb)) {

		ring->arp_reply[reply_idx].has_vlan = true;

		ring->arp_reply[reply_idx].vlan_tci = skb_vlan_tag_get(skb);

		skb_vlan_pop(skb);

		if (likely(!skb_vlan_pop(skb)))

			len += VLAN_HLEN;

		else

			goto err_vlan_head;

	} else {

		ring->arp_reply[reply_idx].has_vlan = false;

	}
@@ -108,6 +110,11 @@ int hns3_handle_roh_arp_req(struct sk_buff *skb, struct hns3_nic_priv *priv) 
	dev_kfree_skb_any(skb);

	napi_schedule(&ring->tqp_vector->napi);

	return NETDEV_TX_OK;



err_vlan_head:

	hns3_ring_stats_update(ring, tx_vlan_err);

	dev_kfree_skb_any(skb);

	return NETDEV_TX_OK;

}



static struct sk_buff *setup_arp_reply_skb(struct hns3_arp_reply *arp_reply,