| Message ID | 1475140241-23586-1-git-send-email-shmulik.ladkani@gmail.com |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
David, On Thu, 29 Sep 2016 12:10:40 +0300 Shmulik Ladkani <shmulik.ladkani@gmail.com> wrote: > This patch fixes act_vlan to point to the mac_header prior calling > skb_vlan_*() functions, as other callers do. > This 1/2 patch fixes the problem detailed in [1] for act_vlan, last known caller of skb_vlan_*() with skb->data not at mac_header. I think it's a good candidate for -stable; it fixes the observed bug and it is rather focused. Subsequent 2/2 patch hermetically seals the future possibility that one might call skb_vlan_*() with skb->data not at mac_header. This might go to stable as well, but not strictly required. Thanks, Shmulik [1] https://patchwork.ozlabs.org/patch/676111/
From: Shmulik Ladkani <shmulik.ladkani@gmail.com> Date: Thu, 29 Sep 2016 12:10:40 +0300 > Generic skb_vlan_push/skb_vlan_pop functions don't properly handle the > case where the input skb data pointer does not point at the mac header: > > - They're doing push/pop, but fail to properly unwind data back to its > original location. > For example, in the skb_vlan_push case, any subsequent > 'skb_push(skb, skb->mac_len)' calls make the skb->data point 4 bytes > BEFORE start of frame, leading to bogus frames that may be transmitted. > > - They update rcsum per the added/removed 4 bytes tag. > Alas if data is originally after the vlan/eth headers, then these > bytes were already pulled out of the csum. > > OTOH calling skb_vlan_push/skb_vlan_pop with skb->data at mac_header > present no issues. > > act_vlan is the only caller to skb_vlan_*() that has skb->data pointing > at network header (upon ingress). > Other calles (ovs, bpf) already adjust skb->data at mac_header. > > This patch fixes act_vlan to point to the mac_header prior calling > skb_vlan_*() functions, as other callers do. > > Signed-off-by: Shmulik Ladkani <shmulik.ladkani@gmail.com> Applied and queued up for -stable.
diff --git a/net/sched/act_vlan.c b/net/sched/act_vlan.c index 691409de3e..4ffc6c13a5 100644 --- a/net/sched/act_vlan.c +++ b/net/sched/act_vlan.c @@ -36,6 +36,12 @@ static int tcf_vlan(struct sk_buff *skb, const struct tc_action *a, bstats_update(&v->tcf_bstats, skb); action = v->tcf_action; + /* Ensure 'data' points at mac_header prior calling vlan manipulating + * functions. + */ + if (skb_at_tc_ingress(skb)) + skb_push_rcsum(skb, skb->mac_len); + switch (v->tcfv_action) { case TCA_VLAN_ACT_POP: err = skb_vlan_pop(skb); @@ -57,6 +63,9 @@ drop: action = TC_ACT_SHOT; v->tcf_qstats.drops++; unlock: + if (skb_at_tc_ingress(skb)) + skb_pull_rcsum(skb, skb->mac_len); + spin_unlock(&v->tcf_lock); return action; }
Generic skb_vlan_push/skb_vlan_pop functions don't properly handle the case where the input skb data pointer does not point at the mac header: - They're doing push/pop, but fail to properly unwind data back to its original location. For example, in the skb_vlan_push case, any subsequent 'skb_push(skb, skb->mac_len)' calls make the skb->data point 4 bytes BEFORE start of frame, leading to bogus frames that may be transmitted. - They update rcsum per the added/removed 4 bytes tag. Alas if data is originally after the vlan/eth headers, then these bytes were already pulled out of the csum. OTOH calling skb_vlan_push/skb_vlan_pop with skb->data at mac_header present no issues. act_vlan is the only caller to skb_vlan_*() that has skb->data pointing at network header (upon ingress). Other calles (ovs, bpf) already adjust skb->data at mac_header. This patch fixes act_vlan to point to the mac_header prior calling skb_vlan_*() functions, as other callers do. Signed-off-by: Shmulik Ladkani <shmulik.ladkani@gmail.com> Cc: Daniel Borkmann <daniel@iogearbox.net> Cc: Pravin Shelar <pshelar@ovn.org> Cc: Jiri Pirko <jiri@mellanox.com> --- net/sched/act_vlan.c | 9 +++++++++ 1 file changed, 9 insertions(+)