From patchwork Sun Dec 18 19:00:25 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mahesh Bandewar X-Patchwork-Id: 706844 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3thYKK2DC1z9t5m for ; Mon, 19 Dec 2016 06:00:37 +1100 (AEDT) Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=bandewar-net.20150623.gappssmtp.com header.i=@bandewar-net.20150623.gappssmtp.com header.b="jvfulhYi"; dkim-atps=neutral Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753427AbcLRTAb (ORCPT ); Sun, 18 Dec 2016 14:00:31 -0500 Received: from mail-pg0-f66.google.com ([74.125.83.66]:34933 "EHLO mail-pg0-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752170AbcLRTAb (ORCPT ); Sun, 18 Dec 2016 14:00:31 -0500 Received: by mail-pg0-f66.google.com with SMTP id p66so15975945pga.2 for ; Sun, 18 Dec 2016 11:00:30 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bandewar-net.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id; bh=Jkh/jIQDg3aaoC8Jc7X871ChO0YlMWrb5gMsG4H9PaE=; b=jvfulhYix5hKuRPV0kziHWy5JRepF3iM3tIzPZq9bZwAXeodHGjaQbiYhgJPzforZf okC4+jthm0b0kRbaPvi8J9Zvi0kgbOiAGHGshWtPXCyN+bOyLPycjby2VzixLNR+x95A AYpDIQkn117HfeoJ1pazXcG67U9yALBRniQl1dk4WMYvcmDdCVOwqndNFVco97dlUa6j l1e/W8sE93eb4/w0hwmPf4SPSYTWnZQlBSgtdqsypnM4r8Pre9rGLvOz5BoyZTU9xu/E Zrg7ESSle4jXLbZ7YG7KdE0N62RM2pQVM7HfNTdD6HxUvFSmKTlqPgls8csp9/aaVBqW jw3Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=Jkh/jIQDg3aaoC8Jc7X871ChO0YlMWrb5gMsG4H9PaE=; b=hVZ7pVWKj2LHzFWn03bzLkzYEEw5RQCLDAASlpbOMU5CMexRIZDO52+jwt902FAhAW 7vlILBiaCzE5E3BeTjKihqwClr/KBNhzGjmoSP8aG06tLWBBFgbCbkxxORjn6Mq33lWT cz/P0CzIWF7JUCN6Ai24BbKJQ/zqc9KtOANwrpBKQTiQDqKowgbiwHNLpR0NJHNx+4M2 VHEhwi9jNasrp+wPhcRO01YUHfa+Ho5maLl0gFVsVugW7BJ0rcZM6zbEgKjQgjlmVzRA LO1ydGNZ8sKBEQhIoJPmduQgBjm4v6K6GUuwyI/MyqE6VbaaVZilDZTPXvkEnADggJrA KsEA== X-Gm-Message-State: AKaTC01z2OMZpksyp4pC6rxRWNLfEVxoL9nySqhRPElvDLknn8okS9ZdvKDqv6zeqBjZnQ== X-Received: by 10.84.138.3 with SMTP id 3mr27678225plo.108.1482087630290; Sun, 18 Dec 2016 11:00:30 -0800 (PST) Received: from localhost ([2620:0:1000:3012:d4e7:8762:1a27:2e59]) by smtp.gmail.com with ESMTPSA id y20sm25758847pfj.26.2016.12.18.11.00.28 (version=TLS1_2 cipher=AES128-SHA bits=128/128); Sun, 18 Dec 2016 11:00:29 -0800 (PST) From: Mahesh Bandewar To: netdev , Eric Dumazet , David Miller Cc: Mahesh Bandewar Subject: [PATCH net v2] ipvlan: fix crash when master is set in loopback mode Date: Sun, 18 Dec 2016 11:00:25 -0800 Message-Id: <1482087625-30366-1-git-send-email-mahesh@bandewar.net> X-Mailer: git-send-email 2.8.0.rc3.226.g39d4020 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Mahesh Bandewar In an IPvlan setup when master is set in loopback mode e.g. ethtool -K eth0 set loopback on where eth0 is master device for IPvlan setup. The failure actually happens while processing mulitcast packets but that's a result of unconditionally queueing packets without ensuring ether-header is part of the linear part of skb. This patch forces this check at the reception and drops packets which fail this check before queuing them. ------------[ cut here ]------------ kernel BUG at include/linux/skbuff.h:1737! Call Trace: [] dev_forward_skb+0x92/0xd0 [] ipvlan_process_multicast+0x395/0x4c0 [ipvlan] [] ? ipvlan_process_multicast+0xd7/0x4c0 [ipvlan] [] ? process_one_work+0x147/0x660 [] process_one_work+0x1a9/0x660 [] ? process_one_work+0x147/0x660 [] worker_thread+0x11d/0x360 [] ? rescuer_thread+0x350/0x350 [] kthread+0xdb/0xe0 [] ? _raw_spin_unlock_irq+0x30/0x50 [] ? flush_kthread_worker+0xc0/0xc0 [] ret_from_fork+0x9a/0xd0 [] ? flush_kthread_worker+0xc0/0xc0 Signed-off-by: Mahesh Bandewar --- v1->v2: commit log update drivers/net/ipvlan/ipvlan_core.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c index b4e990743e1d..4294fc1f5564 100644 --- a/drivers/net/ipvlan/ipvlan_core.c +++ b/drivers/net/ipvlan/ipvlan_core.c @@ -660,6 +660,9 @@ rx_handler_result_t ipvlan_handle_frame(struct sk_buff **pskb) if (!port) return RX_HANDLER_PASS; + if (unlikely(!pskb_may_pull(skb, sizeof(struct ethhdr)))) + goto out; + switch (port->mode) { case IPVLAN_MODE_L2: return ipvlan_handle_mode_l2(pskb, port); @@ -672,6 +675,8 @@ rx_handler_result_t ipvlan_handle_frame(struct sk_buff **pskb) /* Should not reach here */ WARN_ONCE(true, "ipvlan_handle_frame() called for mode = [%hx]\n", port->mode); + +out: kfree_skb(skb); return RX_HANDLER_CONSUMED; }