Kernel bridge driver dropping packets as "invalid header"

Here is the patch submitted to upstream net tree. Waiting for it to be accepted:

From: Sarveshwar Bandi <email address hidden>

If lower layer driver leaves the ip header in the skb fragment, it needs to be first pulled into skb->data before inspecting ip header length or ip version number.

Signed-off-by: Sarveshwar Bandi <email address hidden>
---
 net/bridge/br_netfilter.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c index 68e8f36..fe43bc7 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -265,6 +265,9 @@ static int br_parse_ip_options(struct sk_buff *skb)
  struct net_device *dev = skb->dev;
  u32 len;

+ if (!pskb_may_pull(skb, sizeof(struct iphdr)))
+ goto inhdr_error;
+
  iph = ip_hdr(skb);
  opt = &(IPCB(skb)->opt);

--
1.7.9.5

The patch submitted to upstream net tree has been applied. Please pull this patch to fix this issue.

Details of the commit are here:

http://git.kernel.org/?p=linux/kernel/git/davem/net.git;a=commit;h=6caab7b0544e83e6c160b5e80f5a4a7dd69545c7

Thanks,
Sarvesh

This bug is awaiting verification that the kernel for Precise in -proposed solves the problem (3.2.0-33.52). Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-precise' to 'verification-done-precise'.

If verification is not done by one week from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

This bug is awaiting verification that the kernel for Quantal in -proposed solves the problem (3.5.0-18.29). Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-quantal' to 'verification-done-quantal'.

If verification is not done by one week from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

I tested this and it is working for me in precise.

This bug was fixed in the package linux - 3.5.0-18.29

---------------
linux (3.5.0-18.29) quantal-proposed; urgency=low

  [Luis Henriques]

  * Release Tracking Bug
    - LP: #1068224

  [ Andy Whitcroft ]

  * [packaging] do not fail secure copy on older kernels
  * SAUCE: efivarfs: efivarfs_file_read ensure we free data in error paths
    - LP: #1063061
  * SAUCE: efivars: efivarfs_create() ensure we drop our reference on inode
    on error
    - LP: #1063061
  * SAUCE: efivarfs: efivarfs_fill_super() fix inode reference counts
    - LP: #1063061
  * SAUCE: efivarfs: efivarfs_fill_super() ensure we free our temporary
    name
    - LP: #1063061
  * SAUCE: efivarfs: efivarfs_fill_super() ensure we clean up correctly on
    error
    - LP: #1063061
  * [Config] add fs/udf to linux-image to support DVD/CD formats in virtual
    instances
    - LP: #1066921

  [ Jeremy Kerr ]

  * SAUCE: efi: Handle deletions and size changes in efivarfs_write_file
    - LP: #1063061
  * SAUCE: efivarfs: Implement exclusive access for {get, set}_variable
    - LP: #1063061

  [ Kamal Mostafa ]

  * SAUCE: input: Cypress PS/2 Trackpad list additional contributors

  [ Kyle Fazzari ]

  * SAUCE: input: Cypress PS/2 Trackpad fix lost sync upon palm contact
    - LP: #1048258
  * SAUCE: input: Cypress PS/2 Trackpad fix taps turning into hardware
    clicks
    - LP: #1064086

  [ Leann Ogasawara ]

  * Revert "SAUCE: ext4: fix crash when accessing /proc/mounts
    concurrently"
    - LP: #1066176
  * Revert "SAUCE: ALSA: hda/realtek - Fix detection of ALC271X codec"
    - LP: #1066176

  [ Lee, Chun-Yi ]

  * SAUCE: efi: add efivars kobject to efi sysfs folder
    - LP: #1063061

  [ Matt Fleming ]

  * SAUCE: efivarfs: Add documentation for the EFI variable filesystem
    - LP: #1063061

  [ Matthew Garrett ]

  * SAUCE: efi: Add support for a UEFI variable filesystem
    - LP: #1063061

  [ Sarveshwar Bandi ]

  * SAUCE: bridge: Pull ip header into skb->data before looking into ip
    header.
    - LP: #1065150

  [ Upstream Kernel Changes ]

  * Revert "drm/i915: correctly order the ring init sequence"
    - LP: #1066176
  * vfs: dcache: fix deadlock in tree traversal
    - LP: #1063761
  * dm mpath: only retry ioctl when no paths if queue_if_no_path set
    - LP: #1063761
  * dm: handle requests beyond end of device instead of using BUG_ON
    - LP: #1063761
  * dm table: clear add_random unless all devices have it set
    - LP: #1063761
  * dm verity: fix overflow check
    - LP: #1063761
  * usb: gadget: make g_printer enumerate again
    - LP: #1063761
  * usb: gadget: initialize the strings in tcm_usb_gadget properly
    - LP: #1063761
  * USB: option: blacklist QMI interface on ZTE MF683
    - LP: #1063761
  * USB: ftdi_sio: add TIAO USB Multi-Protocol Adapter (TUMPA) support
    - LP: #1063761
  * USB: qcaux: add Pantech vendor class match
    - LP: #1063761
  * usb: host: xhci: Fix Null pointer dereferencing with 71c731a for
    non-x86 systems
    - LP: #1063761
  * USB: serial: fix up bug with missing {}
    - LP: #1063761
  * staging: speakup_soft: Fix reading of init string
    - LP: #1063761
  * tty: keyboard.c: Remove locking from vt_get_leds.
  ...

The verification of this Stable Release Update has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regresssions.

This bug was fixed in the package linux - 3.2.0-33.52

---------------
linux (3.2.0-33.52) precise-proposed; urgency=low

  [Luis Henriques]

  * Release Tracking Bug
    - LP: #1067666

  [ Andy Whitcroft ]

  * [Config] add fs/udf to linux-image to support DVD/CD formats in virtual
    instances
    - LP: #1066921

  [ James M Leddy ]

  * SAUCE: input: fix weird issue of synaptics psmouse sync lost after
    resume
    - LP: #717970

  [ Paolo Pisati ]

  * [SRU] [Config] enable TIDSPBRIDGE for omap arm[el|hf] flavours
    - LP: #1058022

  [ Sarveshwar Bandi ]

  * SAUCE: bridge: Pull ip header into skb->data before looking into ip
    header.
    - LP: #1065150

  [ Upstream Kernel Changes ]

  * Revert "drm/radeon: rework pll selection (v3)"
    - LP: #1065047
  * sched: Fix migration thread runtime bogosity
    - LP: #1057593
  * Bluetooth: Add support for Sony Vaio T-Series
    - LP: #1054307
  * drm/radeon: properly handle mc_stop/mc_resume on evergreen+ (v2)
    - LP: #1058303
  * Bluetooth: Use USB_VENDOR_AND_INTERFACE() for Broadcom devices
    - LP: #1058303
  * Bluetooth: Add USB_VENDOR_AND_INTERFACE_INFO() for Broadcom/Foxconn
    - LP: #1030233, #1058303
  * target: Fix ->data_length re-assignment bug with SCSI overflow
    - LP: #1065047
  * ASoC: samsung dma - Don't indicate support for pause/resume.
    - LP: #1065047
  * fs/proc: fix potential unregister_sysctl_table hang
    - LP: #1065047
  * mm/ia64: fix a memory block size bug
    - LP: #1065047
  * nbd: clear waiting_queue on shutdown
    - LP: #1065047
  * drivers/rtc/rtc-twl.c: ensure all interrupts are disabled during probe
    - LP: #1065047
  * mm/page_alloc: fix the page address of higher page's buddy calculation
    - LP: #1065047
  * memory hotplug: fix section info double registration bug
    - LP: #1065047
  * cciss: fix handling of protocol error
    - LP: #1065047
  * vfs: dcache: use DCACHE_DENTRY_KILLED instead of DCACHE_DISCONNECTED in
    d_kill()
    - LP: #1065047
  * workqueue: reimplement work_on_cpu() using system_wq
    - LP: #1065047
  * cpufreq/powernow-k8: workqueue user shouldn't migrate the kworker to
    another CPU
    - LP: #1065047
  * sched: Fix ancient race in do_exit()
    - LP: #1065047
  * hpwdt: Fix kdump issue in hpwdt
    - LP: #1065047
  * rtlwifi: rtl8192ce: Log message that B_CUT device may not work
    - LP: #1065047
  * brcmfmac: fix big endian bug in i-scan.
    - LP: #1065047
  * brcmfmac: Fix big endian host configuration data.
    - LP: #1065047
  * dmaengine: at_hdmac: fix comment in atc_prep_slave_sg()
    - LP: #1065047
  * dmaengine: at_hdmac: check that each sg data length is non-null
    - LP: #1065047
  * ARM: 7532/1: decompressor: reset SCTLR.TRE for VMSA ARMv7 cores
    - LP: #1065047
  * drm/i915: Reduce a pin-leak BUG into a WARN
    - LP: #1065047
  * bnx2i: Fixed NULL ptr deference for 1G bnx2 Linux iSCSI offload
    - LP: #1065047
  * mpt2sas: Fix for issue - Unable to boot from the drive connected to HBA
    - LP: #1065047
  * hwmon: (ads7871) Add 'name' sysfs attribute
    - LP: #1065047
  * DMA: PL330: Check the pointer returned by kzalloc
    - LP: #1065047
  * hpsa: fix handling of protocol error
    -...