net: bridge: check the length of skb after nf_bridge_maybe_copy_header()
authorChangli Gao <xiaosuo@gmail.com>
Sat, 25 Dec 2010 03:41:30 +0000 (03:41 +0000)
committerDavid S. Miller <davem@davemloft.net>
Thu, 6 Jan 2011 19:33:05 +0000 (11:33 -0800)
Since nf_bridge_maybe_copy_header() may change the length of skb,
we should check the length of skb after it to handle the ppoe skbs.

Signed-off-by: Changli Gao <xiaosuo@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/bridge/br_forward.c

index 2bd11ec6d1664d29bce00a55e88d4e527d1a03e3..ee64287f1290d5a1f35ca9f7b64aeb4bac21eedf 100644 (file)
@@ -41,17 +41,13 @@ static inline unsigned packet_length(const struct sk_buff *skb)
 
 int br_dev_queue_push_xmit(struct sk_buff *skb)
 {
-       /* drop mtu oversized packets except gso */
-       if (packet_length(skb) > skb->dev->mtu && !skb_is_gso(skb))
+       /* ip_fragment doesn't copy the MAC header */
+       if (nf_bridge_maybe_copy_header(skb) ||
+           (packet_length(skb) > skb->dev->mtu && !skb_is_gso(skb))) {
                kfree_skb(skb);
-       else {
-               /* ip_fragment doesn't copy the MAC header */
-               if (nf_bridge_maybe_copy_header(skb))
-                       kfree_skb(skb);
-               else {
-                       skb_push(skb, ETH_HLEN);
-                       dev_queue_xmit(skb);
-               }
+       } else {
+               skb_push(skb, ETH_HLEN);
+               dev_queue_xmit(skb);
        }
 
        return 0;