From: Toshiaki Makita <makita.toshi...@lab.ntt.co.jp> Date: Thu, 29 Mar 2018 19:05:28 +0900
> Eric Dumazet reported syzbot found a new bug which leads to underflow of > size argument of memmove(), causing crash[1]. This can be triggered by tun > devices. > > The underflow happened because skb_vlan_untag() did not expect vlan packets > without ethernet headers, and tun can produce such packets. > I also checked vlan_insert_inner_tag() and found a similar bug. > > This series fixes these problems. > > [1] https://marc.info/?l=linux-netdev&m=152221753920510&w=2 Series applied, thank you.
