From: Vasily Averin <vvs@virtuozzo.com>
To: "David S. Miller" <davem@davemloft.net>,
Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>,
David Ahern <dsahern@kernel.org>,
Jakub Kicinski <kuba@kernel.org>
Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH IPV6 1/1] ipv6: allocate enough headroom in ip6_finish_output2()
Date: Wed, 7 Jul 2021 17:04:51 +0300 [thread overview]
Message-ID: <3cb5a2e5-4e4c-728a-252d-4757b6c9612d@virtuozzo.com> (raw)
In-Reply-To: <cover.1625665132.git.vvs@virtuozzo.com>
When TEE target mirrors traffic to another interface, sk_buff may
not have enough headroom to be processed correctly.
ip_finish_output2() detect this situation for ipv4 and allocates
new skb with enogh headroom. However ipv6 lacks this logic in
ip_finish_output2 and it leads to skb_under_panic:
skbuff: skb_under_panic: text:ffffffffc0866ad4 len:96 put:24
head:ffff97be85e31800 data:ffff97be85e317f8 tail:0x58 end:0xc0 dev:gre0
------------[ cut here ]------------
kernel BUG at net/core/skbuff.c:110!
invalid opcode: 0000 [#1] SMP PTI
CPU: 2 PID: 393 Comm: kworker/2:2 Tainted: G OE 5.13.0 #13
Hardware name: Virtuozzo KVM, BIOS 1.11.0-2.vz7.4 04/01/2014
Workqueue: ipv6_addrconf addrconf_dad_work
RIP: 0010:skb_panic+0x48/0x4a
Call Trace:
skb_push.cold.111+0x10/0x10
ipgre_header+0x24/0xf0 [ip_gre]
neigh_connected_output+0xae/0xf0
ip6_finish_output2+0x1a8/0x5a0
ip6_output+0x5c/0x110
nf_dup_ipv6+0x158/0x1000 [nf_dup_ipv6]
tee_tg6+0x2e/0x40 [xt_TEE]
ip6t_do_table+0x294/0x470 [ip6_tables]
nf_hook_slow+0x44/0xc0
nf_hook.constprop.34+0x72/0xe0
ndisc_send_skb+0x20d/0x2e0
ndisc_send_ns+0xd1/0x210
addrconf_dad_work+0x3c8/0x540
process_one_work+0x1d1/0x370
worker_thread+0x30/0x390
kthread+0x116/0x130
ret_from_fork+0x22/0x30
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
---
net/ipv6/ip6_output.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index ff4f9eb..e5af740 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -61,9 +61,24 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff *
struct dst_entry *dst = skb_dst(skb);
struct net_device *dev = dst->dev;
const struct in6_addr *nexthop;
+ unsigned int hh_len = LL_RESERVED_SPACE(dev);
struct neighbour *neigh;
int ret;
+ /* Be paranoid, rather than too clever. */
+ if (unlikely(skb_headroom(skb) < hh_len && dev->header_ops)) {
+ struct sk_buff *skb2;
+
+ skb2 = skb_realloc_headroom(skb, LL_RESERVED_SPACE(dev));
+ if (!skb2) {
+ kfree_skb(skb);
+ return -ENOMEM;
+ }
+ if (skb->sk)
+ skb_set_owner_w(skb2, skb->sk);
+ consume_skb(skb);
+ skb = skb2;
+ }
if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr)) {
struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
--
1.8.3.1
next parent reply other threads:[~2021-07-07 14:04 UTC|newest]
Thread overview: 106+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <cover.1625665132.git.vvs@virtuozzo.com>
2021-07-07 14:04 ` Vasily Averin [this message]
2021-07-07 14:45 ` [PATCH IPV6 1/1] ipv6: allocate enough headroom in ip6_finish_output2() David Ahern
2021-07-07 16:42 ` Jakub Kicinski
2021-07-07 17:41 ` Eric Dumazet
2021-07-07 17:53 ` Vasily Averin
2021-07-07 18:30 ` Jakub Kicinski
2021-07-07 18:50 ` Eric Dumazet
2021-07-09 9:04 ` [PATCH IPV6 v2 0/4] " Vasily Averin
2021-07-12 6:44 ` [PATCH IPV6 v3 0/1] " Vasily Averin
[not found] ` <cover.1626069562.git.vvs@virtuozzo.com>
2021-07-12 6:45 ` [PATCH IPV6 v3 1/1] " Vasily Averin
2021-07-12 18:30 ` patchwork-bot+netdevbpf
2021-07-13 7:46 ` Vasily Averin
2021-07-13 12:01 ` [PATCH NET v4 0/1] " Vasily Averin
[not found] ` <cover.1626177047.git.vvs@virtuozzo.com>
2021-07-13 12:01 ` [PATCH NET v4 1/1] " Vasily Averin
2021-07-18 10:44 ` Vasily Averin
2021-07-18 15:22 ` David Ahern
2021-07-18 17:04 ` David Miller
2021-07-19 7:55 ` [PATCH NET] ipv6: ip6_finish_output2: set sk into newly allocated nskb Vasily Averin
2021-07-20 10:10 ` patchwork-bot+netdevbpf
2021-07-13 12:31 ` [PATCH IPV6 v3 1/1] ipv6: allocate enough headroom in ip6_finish_output2() Vasily Averin
2021-07-12 13:26 ` [PATCH NET 0/7] skbuff: introduce pskb_realloc_headroom() Vasily Averin
[not found] ` <cover.1626093470.git.vvs@virtuozzo.com>
2021-07-12 13:26 ` [PATCH NET 1/7] " Vasily Averin
2021-07-12 17:53 ` Jakub Kicinski
2021-07-12 18:45 ` Vasily Averin
2021-07-13 20:57 ` [PATCH NET v2 0/7] skbuff: introduce skb_expand_head() Vasily Averin
2021-08-02 8:52 ` [PATCH NET v3 " Vasily Averin
[not found] ` <cover.1627891754.git.vvs@virtuozzo.com>
2021-08-02 8:52 ` [PATCH NET v3 1/7] " Vasily Averin
2021-08-02 8:52 ` [PATCH NET v3 2/7] ipv6: use skb_expand_head in ip6_finish_output2 Vasily Averin
2021-08-02 8:52 ` [PATCH NET v3 3/7] ipv6: use skb_expand_head in ip6_xmit Vasily Averin
2021-08-02 8:52 ` [PATCH NET v3 4/7] ipv4: use skb_expand_head in ip_finish_output2 Vasily Averin
2021-08-02 8:52 ` [PATCH NET v3 5/7] vrf: use skb_expand_head in vrf_finish_output Vasily Averin
2021-08-05 11:55 ` Julian Wiedmann
2021-08-05 12:55 ` Vasily Averin
2021-08-06 7:49 ` [PATCH NET v4 0/7] skbuff: introduce skb_expand_head() Vasily Averin
2021-08-06 10:14 ` David Miller
2021-08-06 12:53 ` [PATCH NET] vrf: fix null pointer dereference in vrf_finish_output() Vasily Averin
2021-08-06 22:42 ` Jakub Kicinski
2021-08-07 6:41 ` Vasily Averin
[not found] ` <cover.1628235065.git.vvs@virtuozzo.com>
2021-08-06 7:49 ` [PATCH NET v4 1/7] skbuff: introduce skb_expand_head() Vasily Averin
2021-08-06 7:50 ` [PATCH NET v4 2/7] ipv6: use skb_expand_head in ip6_finish_output2 Vasily Averin
2021-08-06 7:50 ` [PATCH NET v4 3/7] ipv6: use skb_expand_head in ip6_xmit Vasily Averin
[not found] ` <CALMXkpaay1y=0tkbnskr4gf-HTMjJJsVryh4Prnej_ws-hJvBg@mail.gmail.com>
2021-08-20 22:44 ` Christoph Paasch
2021-08-21 6:21 ` Vasily Averin
2021-08-22 17:04 ` Christoph Paasch
2021-08-22 17:13 ` Christoph Paasch
2021-08-23 5:44 ` Vasily Averin
2021-08-23 5:59 ` Vasily Averin
2021-08-23 7:56 ` [PATCH NET-NEXT] ipv6: skb_expand_head() adjust skb->truesize incorrectly Vasily Averin
2021-08-23 17:25 ` Christoph Paasch
2021-08-23 21:45 ` Eric Dumazet
2021-08-23 21:51 ` Eric Dumazet
2021-08-23 22:23 ` Eric Dumazet
2021-08-24 8:50 ` Vasily Averin
2021-08-24 17:21 ` Vasily Averin
2021-08-25 17:49 ` Christoph Paasch
2021-08-29 12:59 ` [PATCH v2] " Vasily Averin
2021-08-30 5:52 ` [PATCH net-next " Vasily Averin
2021-08-30 16:01 ` [PATCH " Eric Dumazet
2021-08-30 18:09 ` Vasily Averin
2021-08-30 18:37 ` Vasily Averin
2021-08-30 19:58 ` Eric Dumazet
2021-08-31 14:34 ` [PATCH net-next v3 RFC] " Vasily Averin
2021-08-31 19:38 ` Eric Dumazet
2021-09-01 6:20 ` Vasily Averin
2021-09-01 8:11 ` [PATCH net-next v4] " Vasily Averin
2021-09-01 16:58 ` Christoph Paasch
2021-09-01 19:17 ` Eric Dumazet
2021-09-02 3:59 ` Vasily Averin
2021-09-02 4:32 ` Eric Dumazet
2021-09-02 4:48 ` Eric Dumazet
2021-09-02 7:13 ` Vasily Averin
2021-09-02 7:33 ` Vasily Averin
2021-09-02 8:31 ` Vasily Averin
2021-09-02 11:12 ` [PATCH net-next v5] " Vasily Averin
2021-09-02 15:53 ` Christoph Paasch
2021-09-02 16:32 ` Vasily Averin
2021-09-06 18:01 ` [PATCH net v6] " Vasily Averin
2021-09-06 18:03 ` Vasily Averin
2021-08-27 15:23 ` [PATCH NET-NEXT] ipv6: " Vasily Averin
2021-08-27 16:47 ` Eric Dumazet
2021-08-28 8:01 ` Vasily Averin
2021-08-06 7:50 ` [PATCH NET v4 4/7] ipv4: use skb_expand_head in ip_finish_output2 Vasily Averin
2021-08-06 7:50 ` [PATCH NET v4 5/7] vrf: use skb_expand_head in vrf_finish_output Vasily Averin
2021-08-06 7:50 ` [PATCH NET v4 6/7] ax25: use skb_expand_head Vasily Averin
2021-08-06 7:50 ` [PATCH NET v4 7/7] bpf: use skb_expand_head in bpf_out_neigh_v4/6 Vasily Averin
2021-08-02 8:52 ` [PATCH NET v3 6/7] ax25: use skb_expand_head Vasily Averin
2021-08-02 8:52 ` [PATCH NET v3 7/7] bpf: use skb_expand_head in bpf_out_neigh_v4/6 Vasily Averin
[not found] ` <cover.1626206993.git.vvs@virtuozzo.com>
2021-07-13 20:57 ` [PATCH NET v2 1/7] skbuff: introduce skb_expand_head() Vasily Averin
2021-07-13 20:58 ` [PATCH NET v2 2/7] ipv6: use skb_expand_head in ip6_finish_output2 Vasily Averin
2021-07-13 20:58 ` [PATCH NET v2 3/7] ipv6: use skb_expand_head in ip6_xmit Vasily Averin
2021-07-13 20:58 ` [PATCH NET v2 4/7] ipv4: use skb_expand_head in ip_finish_output2 Vasily Averin
2021-07-13 20:58 ` [PATCH NET v2 5/7] vrf: use skb_expand_head in vrf_finish_output Vasily Averin
2021-07-13 20:58 ` [PATCH NET v2 6/7] ax25: use skb_expand_head Vasily Averin
2021-07-13 20:58 ` [PATCH NET v2 7/7] bpf: use skb_expand_head in bpf_out_neigh_v4/6 Vasily Averin
2021-07-12 13:26 ` [PATCH NET 2/7] ipv6: use pskb_realloc_headroom in ip6_finish_output2 Vasily Averin
2021-07-12 13:26 ` [PATCH NET 3/7] ipv6: use pskb_realloc_headroom in ip6_xmit refactoring Vasily Averin
2021-07-12 13:27 ` [PATCH NET 4/7] ipv4: use pskb_realloc_headroom in ip_finish_output2 Vasily Averin
2021-07-12 13:27 ` [PATCH NET 5/7] vrf: use pskb_realloc_headroom in vrf_finish_output Vasily Averin
2021-07-12 13:27 ` [PATCH NET 6/7] ax25: use pskb_realloc_headroom Vasily Averin
2021-07-12 13:27 ` [PATCH NET 7/7] bpf: use pskb_realloc_headroom in bpf_out_neigh_v4/6 Vasily Averin
[not found] ` <cover.1625818825.git.vvs@virtuozzo.com>
2021-07-09 9:04 ` [PATCH IPV6 v2 1/4] ipv6: allocate enough headroom in ip6_finish_output2() Vasily Averin
2021-07-09 17:58 ` David Miller
2021-07-10 2:53 ` Vasily Averin
2021-07-09 9:04 ` [PATCH IPV6 v2 2/4] ipv6: use new helper skb_expand_head() in ip6_xmit() Vasily Averin
2021-07-09 9:05 ` [PATCH IPV6 v2 3/4] ipv6: ip6_finish_output2 refactoring Vasily Averin
2021-07-09 9:05 ` [PATCH IPV6 v2 4/4] ipv6: ip6_xmit refactoring Vasily Averin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3cb5a2e5-4e4c-728a-252d-4757b6c9612d@virtuozzo.com \
--to=vvs@virtuozzo.com \
--cc=davem@davemloft.net \
--cc=dsahern@kernel.org \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=yoshfuji@linux-ipv6.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.