From: David S. Miller <davem@davemloft.net>
Date: Fri, 30 Mar 2018 16:36:28 +0000 (-0400)
Subject: Merge branch 'vlan-fix'
X-Git-Tag: v4.19~1369^2~5
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=52a9692a43b8cbca179d2dd02e714df6f1197932;p=platform%2Fkernel%2Flinux-rpi3.git

Merge branch 'vlan-fix'

Toshiaki Makita says:

====================
Fix vlan tag handling for vlan packets without ethernet headers

Eric Dumazet reported syzbot found a new bug which leads to underflow of
size argument of memmove(), causing crash[1]. This can be triggered by tun
devices.

The underflow happened because skb_vlan_untag() did not expect vlan packets
without ethernet headers, and tun can produce such packets.
I also checked vlan_insert_inner_tag() and found a similar bug.

This series fixes these problems.

[1] https://marc.info/?l=linux-netdev&m=152221753920510&w=2
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
---

52a9692a43b8cbca179d2dd02e714df6f1197932