Commit c92510f5 authored by Eric Dumazet's avatar Eric Dumazet Committed by Jakub Kicinski
Browse files

arp: do not assume dev_hard_header() does not change skb->head 



arp_create() is the only dev_hard_header() caller
making assumption about skb->head being unchanged.

A recent commit broke this assumption.

Initialize @arp pointer after dev_hard_header() call.

Fixes: db5b4e39 ("ip6_gre: make ip6gre_header() robust")
Reported-by: default avatar <syzbot+58b44a770a1585795351@syzkaller.appspotmail.com>
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260107212250.384552-1-edumazet@google.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 1f20c774

net/ipv4/arp.c

+4 −3
Original line number Diff line number Diff line
@@ -564,7 +564,7 @@ struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip, 


	skb_reserve(skb, hlen);

	skb_reset_network_header(skb);

	arp = skb_put(skb, arp_hdr_len(dev));

	skb_put(skb, arp_hdr_len(dev));

	skb->dev = dev;

	skb->protocol = htons(ETH_P_ARP);

	if (!src_hw)
@@ -572,12 +572,13 @@ struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip, 
	if (!dest_hw)

		dest_hw = dev->broadcast;



	/*

	 *	Fill the device header for the ARP frame

	/* Fill the device header for the ARP frame.

	 * Note: skb->head can be changed.

	 */

	if (dev_hard_header(skb, dev, ptype, dest_hw, src_hw, skb->len) < 0)

		goto out;



	arp = arp_hdr(skb);

	/*

	 * Fill out the arp protocol part.

	 *