bridge: Pull ip header into skb->data before looking into ip header. (Closes: #697903)

svn path=/dists/sid/linux/; revision=19754

debian/changelog

@@ -91,6 +91,8 @@ linux (3.2.37-1) UNRELEASED; urgency=low
     - sched: Queue RT tasks to head when prio drops
     - sched: Consider pi boosting in setscheduler
   * [s390] s390/time: fix sched_clock() overflow (Closes: #698382) 
+  * bridge: Pull ip header into skb->data before looking into ip header.
+    (Closes: #697903)
 
   [ Aurelien Jarno ]
   * [armhf/vexpress] Add kernel udebs.

debian/patches/bugfix/all/bridge-Pull-ip-header-into-skb-data-before-looking-i.patch

@@ -0,0 +1,30 @@
+From: Sarveshwar Bandi <sarveshwar.bandi@emulex.com>
+Date: Wed, 10 Oct 2012 01:15:01 +0000
+Subject: bridge: Pull ip header into skb->data before looking into ip header.
+
+commit 6caab7b0544e83e6c160b5e80f5a4a7dd69545c7 upstream.
+
+If lower layer driver leaves the ip header in the skb fragment, it needs to
+be first pulled into skb->data before inspecting ip header length or ip version
+number.
+
+Signed-off-by: Sarveshwar Bandi <sarveshwar.bandi@emulex.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ net/bridge/br_netfilter.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
+index 68e8f36..fe43bc7 100644
+--- a/net/bridge/br_netfilter.c
++++ b/net/bridge/br_netfilter.c
+@@ -265,6 +265,9 @@ static int br_parse_ip_options(struct sk_buff *skb)
+ 	struct net_device *dev = skb->dev;
+ 	u32 len;
+ 
++	if (!pskb_may_pull(skb, sizeof(struct iphdr)))
++		goto inhdr_error;
++
+ 	iph = ip_hdr(skb);
+ 	opt = &(IPCB(skb)->opt);
+ 

debian/patches/series

@@ -467,3 +467,4 @@ bugfix/all/vt6656-Fix-inconsistent-structure-packing.patch
 bugfix/all/fs-cachefiles-add-support-for-large-files-in-filesys.patch
 bugfix/x86/xen-Fix-stack-corruption-in-xen_failsafe_callback-fo.patch
 bugfix/s390/s390-time-fix-sched_clock-overflow.patch
+bugfix/all/bridge-Pull-ip-header-into-skb-data-before-looking-i.patch