From: Guillaume Nault <[email protected]>
Date: Fri, 2 Oct 2020 21:53:08 +0200
> Openvswitch allows to drop a packet's Ethernet header, therefore
> skb_mpls_push() and skb_mpls_pop() might be called with ethernet=true
> and mac_len=0. In that case the pointer passed to skb_mod_eth_type()
> doesn't point to an Ethernet header and the new Ethertype is written at
> unexpected locations.
>
> Fix this by verifying that mac_len is big enough to contain an Ethernet
> header.
>
> Fixes: fa4e0f8855fc ("net/sched: fix corrupted L2 header with MPLS 'push' and
> 'pop' actions")
> Signed-off-by: Guillaume Nault <[email protected]>
Applied and queued up for -stable, thanks.
