Re: [PATCH] net: Fix resetting network_header in neigh_resolve_output and neigh_connected_output

[David Miller]

From: Abdelrhman Ahmed <ab@xxxxxxxxxxx>
Date: Mon, 27 Jun 2016 16:28:59 +0200

> @@ -1293,15 +1293,19 @@ int neigh_resolve_output(struct neighbour *neigh, struct sk_buff *skb)
>  	int rc = 0;
>  
>  	if (!neigh_event_send(neigh, skb)) {
> -		int err;
> +		int err, offset;
>  		struct net_device *dev = neigh->dev;
> +		unsigned char *data;
>  		unsigned int seq;
>  
>  		if (dev->header_ops->cache && !neigh->hh.hh_len)
>  			neigh_hh_init(neigh);
>  
> +		data = skb->data;
> +
>  		do {
> -			__skb_pull(skb, skb_network_offset(skb));
> +			offset = data - skb->data;
> +			__skb_pull(skb, offset);

This is definitely not right, using skb->data for this.  It may work
for the cases you have tested but it is not generally correct.

You must use the skb network header.

You are just trying to avoid doing the pull more than once if we loop
right?  Then simply use a boolean to track that.