[IPV4]: Do not use skb_linearize() in ARP handling.

net/ipv4/arp.c

@@ -623,15 +623,20 @@ int arp_process(struct sk_buff *skb)
 	int addr_type;
 	struct neighbour *n;
 
-	/* arp_rcv below verifies the ARP header, verifies the device
-	 * is ARP'able, and linearizes the SKB (if needed).
+	/* arp_rcv below verifies the ARP header and verifies the device
+	 * is ARP'able.
 	 */
 
 	if (in_dev == NULL)
 		goto out;
 
+	/* ARP header, plus 2 device addresses, plus 2 IP addresses.  */
+	if (!pskb_may_pull(skb, (sizeof(struct arphdr) +
+				 (2 * dev->addr_len) +
+				 (2 * sizeof(u32)))))
+		goto out;
+
 	arp = skb->nh.arph;
-	arp_ptr= (unsigned char *)(arp+1);
 
 	switch (dev_type) {
 	default:	
@@ -693,6 +698,7 @@ int arp_process(struct sk_buff *skb)
 /*
  *	Extract fields
  */
+	arp_ptr= (unsigned char *)(arp+1);
 	sha	= arp_ptr;
 	arp_ptr += dev->addr_len;
 	memcpy(&sip, arp_ptr, 4);
@@ -841,11 +847,6 @@ int arp_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt)
 	if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
 		goto out_of_mem;
 
-	if (skb_is_nonlinear(skb)) {
-		if (skb_linearize(skb, GFP_ATOMIC) != 0)
-			goto freeskb;
-	}
-
 	return NF_HOOK(NF_ARP, NF_ARP_IN, skb, dev, NULL, arp_process);
 
 freeskb:

net/ipv4/netfilter/arp_tables.c

@@ -247,14 +247,16 @@ unsigned int arpt_do_table(struct sk_buff **pskb,
 {
 	static const char nulldevname[IFNAMSIZ] = { 0 };
 	unsigned int verdict = NF_DROP;
-	struct arphdr *arp = (*pskb)->nh.arph;
+	struct arphdr *arp;
 	int hotdrop = 0;
 	struct arpt_entry *e, *back;
 	const char *indev, *outdev;
 	void *table_base;
 
-	/* FIXME: Push down to extensions --RR */
-	if (skb_is_nonlinear(*pskb) && skb_linearize(*pskb, GFP_ATOMIC) != 0)
+	/* ARP header, plus 2 device addresses, plus 2 IP addresses.  */
+	if (!pskb_may_pull((*pskb), (sizeof(struct arphdr) +
+				     (2 * (*pskb)->dev->addr_len) +
+				     (2 * sizeof(u32)))))
 		return NF_DROP;
 
 	indev = in ? in->name : nulldevname;
@@ -267,6 +269,7 @@ unsigned int arpt_do_table(struct sk_buff **pskb,
 	e = get_entry(table_base, table->private->hook_entry[hook]);
 	back = get_entry(table_base, table->private->underflow[hook]);
 
+	arp = (*pskb)->nh.arph;
 	do {
 		if (arp_packet_match(arp, (*pskb)->dev, indev, outdev, &e->arp)) {
 			struct arpt_entry_target *t;