From patchwork Sun Mar 23 14:43:52 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Or Gerlitz X-Patchwork-Id: 332887 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 4218E2C00BE for ; Mon, 24 Mar 2014 01:44:33 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752167AbaCWOny (ORCPT ); Sun, 23 Mar 2014 10:43:54 -0400 Received: from mail-pb0-f41.google.com ([209.85.160.41]:33089 "EHLO mail-pb0-f41.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751681AbaCWOnx (ORCPT ); Sun, 23 Mar 2014 10:43:53 -0400 Received: by mail-pb0-f41.google.com with SMTP id jt11so4396328pbb.28 for ; Sun, 23 Mar 2014 07:43:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=NLJeMTdK/v7nxDihZ73ybesSV2HzayuHyNug8JiPD8c=; b=IM/BmQrG2u8MG+rNy2dIVjoGwx0NA0OLozewwYwywmX0vyjjEvQ5JL9+If5rBxHs94 StsBdhEFMkbjgiKMTSu5KQnmeOkyNUbMOiEmkcF3+fNoOqUBy9Eld+K1o/Y1JImFa0K1 yH9C5SZZnAfB2Nxfj0CUHJ1LNWBQtrvBzRsxTp3PZU+pQhWgQ++wPVKlePdhwJJLU8Dz O8kQGKoXSb5tNWI9upmBk/kUD1pIacCRs1JwsqldX7nLm/y1VSrtXwGCU35pofCpNruL b5Vg3i2TRNxk3KuoR0Z1vz++8xZ88cSie/iJDRJ/9P1ryTZSflL5T2EjFfyzWHVXFvgY +h+A== MIME-Version: 1.0 X-Received: by 10.66.251.42 with SMTP id zh10mr66540612pac.84.1395585832428; Sun, 23 Mar 2014 07:43:52 -0700 (PDT) Received: by 10.68.60.198 with HTTP; Sun, 23 Mar 2014 07:43:52 -0700 (PDT) In-Reply-To: References: <1395055050-20874-1-git-send-email-mike.rapoport@ravellosystems.com> <20140320.160229.857536522237793124.davem@davemloft.net> Date: Sun, 23 Mar 2014 16:43:52 +0200 Message-ID: Subject: Re: [PATCH net] net: vxlan: fix crash when interface is created with no group From: Or Gerlitz To: Mike Rapoport Cc: David Stevens , David Miller , netdev Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org On Sun, Mar 23, 2014 at 11:27 AM, Mike Rapoport wrote: > I believe I've groked what's going on in vxlan_udp_encap_recv and > vxlan_rcv. There are actually two unrelated problems: > > 1) When the vxlan is configured with IPv4 group it crashes when it > starts to receive IPv6 IGMP packets encapsulated into IPv4 vxlan > packets. This happens because when ipv6_rcv handles the inner packet, > the skb->dst still refernces outer IPv4 info. The very old vxlan code > had skb_dst_drop call in vxlan_udp_encap_recv, which was removed when > vxlan was refactored to use iptunnel_pull_header (commit > 7ce04758279514ca1d8ebfe322508a4a430fe2c8: "vxlan: Restructure vxlan > receive"). The iptunnel_pull_header called skb_dst_drop until recent > commit 10ddceb22bab11dab10ba645c7df2e4a8e7a5db5 ("ip_tunnel:multicast > process cause panic due to skb->_skb_refdst NULL pointer"). > The simplest fix, I think, would be to restore call to skb_dst_drop in > vxlan_udp_encap_recv. Yep, following Mike's suggestion, adding the below call allows things to work, where trying vxlan without OVS, e.g using $ ip link add vxlan42 type vxlan id 42 group 239.0.0.42 ttl 10 dev ethN $ ifconfig vxlan42 192.168.42.54/24 up over the net tree with 3.14-rc6 and beyond crashes instantly on node A when node B is taken up and starts sending, so commit 10ddceb22b indeed introduced a regression. vs = rcu_dereference_sk_user_data(sk); --- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c index a7eb3f2..22d7484 100644 --- a/drivers/net/vxlan.c +++ b/drivers/net/vxlan.c @@ -1150,6 +1150,8 @@ static int vxlan_udp_encap_recv(struct sock *sk, struct sk_buff *skb) if (iptunnel_pull_header(skb, VXLAN_HLEN, htons(ETH_P_TEB))) goto drop; + skb_dst_drop(skb); + port = inet_sk(sk)->inet_sport;