The result of the memcmp that checks whether the OUI is all zeroes was the reverse of what it should have been. This checkin also removes the masking of the least signficant bit from SAP checks, since it's not need for checking SNAP.
Thanks to Masa and Brandon for catching this.
{
struct snap_hdr *sh = (struct snap_hdr *)(skb->data
+ sizeof(struct ethhdr));
- if (((sh->dsap & 0xFE) != LLC_SAP_SNAP)
- || ((sh->ssap & 0xFE) != LLC_SAP_SNAP)
- || (!memcmp(sh->oui, "\0\0\0", SNAP_OUI_LEN)))
+ if ((sh->dsap != LLC_SAP_SNAP)
+ || (sh->ssap != LLC_SAP_SNAP)
+ || (memcmp(sh->oui, "\0\0\0", SNAP_OUI_LEN)))
return -EINVAL;
*ethertype = sh->ethertype;