From patchwork Sat Jul 11 00:10:11 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alexei Starovoitov X-Patchwork-Id: 493975 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 934BC1402C7 for ; Sat, 11 Jul 2015 17:04:37 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752761AbbGKHEd (ORCPT ); Sat, 11 Jul 2015 03:04:33 -0400 Received: from mail-pd0-f176.google.com ([209.85.192.176]:35383 "EHLO mail-pd0-f176.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752317AbbGKHEc (ORCPT ); Sat, 11 Jul 2015 03:04:32 -0400 Received: by pdrg1 with SMTP id g1so63729437pdr.2 for ; Sat, 11 Jul 2015 00:04:32 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=C8xMoqW6KLT77UXR8kIqa/IjcoW11EcjLL5i3ydcB9k=; b=kZmyd/7UwY7ym6cH1mUUl6bL3kwED4U2EBH3Eh8lK2oCKz0nzw852F/TybOr6B0UTT 9JV0lO4rJRcZSq/vWZ3b/8VGHrgTWMnyMJPfgyvqLt1eIDpaR4pK5AQ48COa6nWdEAy6 yQ61CVJfq568VTJGlgcxWjIVgIJdS52fbzRxwHvSkbAApmpeF7gq1dwpM07otrpgIVFT NyQGhq7IVFKVrz2/qvMpGL56WJv9MQ7dBAs/L81EbuWI8f8SNhzuemP2uhpJcCrG8/55 lcFKACihnvxPW6sWI70kecS2YK4DPlAymPbbZmtx5rgNbf5dQrEeT1qLalsVcuF3eSyj PBPA== X-Gm-Message-State: ALoCoQlhrTGpo4CERu47Kfb5cnt5QQX/OZZ2ZiBNfTsvmvAVipm/M6baDppJHAJAvtFii+b5QCcB X-Received: by 10.70.134.198 with SMTP id pm6mr47135833pdb.17.1436573427303; Fri, 10 Jul 2015 17:10:27 -0700 (PDT) Received: from localhost.localdomain ([12.229.56.227]) by smtp.gmail.com with ESMTPSA id fp3sm10824050pdb.52.2015.07.10.17.10.26 (version=TLSv1.1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Fri, 10 Jul 2015 17:10:26 -0700 (PDT) From: Alexei Starovoitov To: "David S. Miller" Cc: Jamal Hadi Salim , Daniel Borkmann , Jiri Pirko , netdev@vger.kernel.org Subject: [PATCH net-next] tc: fix tc actions in case of shared skb Date: Fri, 10 Jul 2015 17:10:11 -0700 Message-Id: <1436573411-5021-1-git-send-email-ast@plumgrid.com> X-Mailer: git-send-email 1.7.9.5 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org TC actions need to check for very unlikely event skb->users != 1, otherwise subsequent pskb_may_pull/pskb_expand_head will crash. When skb_shared() just drop the packet, since in the middle of actions it's too late to call skb_share_check(), since classifiers/actions assume the same skb pointer. Signed-off-by: Alexei Starovoitov --- net/sched/act_csum.c | 3 +++ net/sched/act_nat.c | 3 +++ net/sched/act_vlan.c | 3 +++ 3 files changed, 9 insertions(+) diff --git a/net/sched/act_csum.c b/net/sched/act_csum.c index b07c535ba8e7..ac150bdc24f4 100644 --- a/net/sched/act_csum.c +++ b/net/sched/act_csum.c @@ -510,6 +510,9 @@ static int tcf_csum(struct sk_buff *skb, if (unlikely(action == TC_ACT_SHOT)) goto drop; + if (unlikely(skb_shared(skb))) + goto drop; + switch (tc_skb_protocol(skb)) { case cpu_to_be16(ETH_P_IP): if (!tcf_csum_ipv4(skb, update_flags)) diff --git a/net/sched/act_nat.c b/net/sched/act_nat.c index 5be0b3c1c5b0..8bb2657de635 100644 --- a/net/sched/act_nat.c +++ b/net/sched/act_nat.c @@ -114,6 +114,9 @@ static int tcf_nat(struct sk_buff *skb, const struct tc_action *a, if (unlikely(action == TC_ACT_SHOT)) goto drop; + if (unlikely(skb_shared(skb))) + goto drop; + noff = skb_network_offset(skb); if (!pskb_may_pull(skb, sizeof(*iph) + noff)) goto drop; diff --git a/net/sched/act_vlan.c b/net/sched/act_vlan.c index 796785e0bf96..6365ae036c6e 100644 --- a/net/sched/act_vlan.c +++ b/net/sched/act_vlan.c @@ -33,6 +33,9 @@ static int tcf_vlan(struct sk_buff *skb, const struct tc_action *a, bstats_update(&v->tcf_bstats, skb); action = v->tcf_action; + if (unlikely(skb_shared(skb))) + goto drop; + switch (v->tcfv_action) { case TCA_VLAN_ACT_POP: err = skb_vlan_pop(skb);