All of lore.kernel.org
 help / color / mirror / Atom feed
From: Jiri Slaby <jslaby@suse.cz>
To: stable@vger.kernel.org
Cc: "Michal Kubeček" <mkubecek@suse.cz>,
	"David S . Miller" <davem@davemloft.net>,
	"Jiri Slaby" <jslaby@suse.cz>
Subject: [patch added to the 3.12 stable tree] ipv6: distinguish frag queues by device for multicast and link-local packets
Date: Tue,  5 Jan 2016 16:28:18 +0100	[thread overview]
Message-ID: <1452007726-3747-17-git-send-email-jslaby@suse.cz> (raw)
In-Reply-To: <1452007726-3747-1-git-send-email-jslaby@suse.cz>

From: Michal Kubeček <mkubecek@suse.cz>

This patch has been added to the 3.12 stable tree. If you have any
objections, please let us know.

===============

[ Upstream commit 264640fc2c5f4f913db5c73fa3eb1ead2c45e9d7 ]

If a fragmented multicast packet is received on an ethernet device which
has an active macvlan on top of it, each fragment is duplicated and
received both on the underlying device and the macvlan. If some
fragments for macvlan are processed before the whole packet for the
underlying device is reassembled, the "overlapping fragments" test in
ip6_frag_queue() discards the whole fragment queue.

To resolve this, add device ifindex to the search key and require it to
match reassembling multicast packets and packets to link-local
addresses.

Note: similar patch has been already submitted by Yoshifuji Hideaki in

  http://patchwork.ozlabs.org/patch/220979/

but got lost and forgotten for some reason.

Signed-off-by: Michal Kubecek <mkubecek@suse.cz>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 include/net/ipv6.h                      |  1 +
 net/ipv6/netfilter/nf_conntrack_reasm.c |  5 +++--
 net/ipv6/reassembly.c                   | 10 +++++++---
 3 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index ea97c94fbc7d..e9ca7fd12aa3 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -485,6 +485,7 @@ struct ip6_create_arg {
 	u32 user;
 	const struct in6_addr *src;
 	const struct in6_addr *dst;
+	int iif;
 	u8 ecn;
 };
 
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 253566a8d55b..7cd623588532 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -172,7 +172,7 @@ static void nf_ct_frag6_expire(unsigned long data)
 /* Creation primitives. */
 static inline struct frag_queue *fq_find(struct net *net, __be32 id,
 					 u32 user, struct in6_addr *src,
-					 struct in6_addr *dst, u8 ecn)
+					 struct in6_addr *dst, int iif, u8 ecn)
 {
 	struct inet_frag_queue *q;
 	struct ip6_create_arg arg;
@@ -182,6 +182,7 @@ static inline struct frag_queue *fq_find(struct net *net, __be32 id,
 	arg.user = user;
 	arg.src = src;
 	arg.dst = dst;
+	arg.iif = iif;
 	arg.ecn = ecn;
 
 	read_lock_bh(&nf_frags.lock);
@@ -590,7 +591,7 @@ struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb, u32 user)
 	local_bh_enable();
 
 	fq = fq_find(net, fhdr->identification, user, &hdr->saddr, &hdr->daddr,
-		     ip6_frag_ecn(hdr));
+		     skb->dev ? skb->dev->ifindex : 0, ip6_frag_ecn(hdr));
 	if (fq == NULL) {
 		pr_debug("Can't find and can't create new queue\n");
 		goto ret_orig;
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index 1aeb473b2cc6..a1fb511da3b5 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -111,7 +111,10 @@ bool ip6_frag_match(struct inet_frag_queue *q, void *a)
 	return	fq->id == arg->id &&
 		fq->user == arg->user &&
 		ipv6_addr_equal(&fq->saddr, arg->src) &&
-		ipv6_addr_equal(&fq->daddr, arg->dst);
+		ipv6_addr_equal(&fq->daddr, arg->dst) &&
+		(arg->iif == fq->iif ||
+		 !(ipv6_addr_type(arg->dst) & (IPV6_ADDR_MULTICAST |
+					       IPV6_ADDR_LINKLOCAL)));
 }
 EXPORT_SYMBOL(ip6_frag_match);
 
@@ -180,7 +183,7 @@ static void ip6_frag_expire(unsigned long data)
 
 static __inline__ struct frag_queue *
 fq_find(struct net *net, __be32 id, const struct in6_addr *src,
-	const struct in6_addr *dst, u8 ecn)
+	const struct in6_addr *dst, int iif, u8 ecn)
 {
 	struct inet_frag_queue *q;
 	struct ip6_create_arg arg;
@@ -190,6 +193,7 @@ fq_find(struct net *net, __be32 id, const struct in6_addr *src,
 	arg.user = IP6_DEFRAG_LOCAL_DELIVER;
 	arg.src = src;
 	arg.dst = dst;
+	arg.iif = iif;
 	arg.ecn = ecn;
 
 	read_lock(&ip6_frags.lock);
@@ -558,7 +562,7 @@ static int ipv6_frag_rcv(struct sk_buff *skb)
 				 IPSTATS_MIB_REASMFAILS, evicted);
 
 	fq = fq_find(net, fhdr->identification, &hdr->saddr, &hdr->daddr,
-		     ip6_frag_ecn(hdr));
+		     skb->dev ? skb->dev->ifindex : 0, ip6_frag_ecn(hdr));
 	if (fq != NULL) {
 		int ret;
 
-- 
2.6.4


  parent reply	other threads:[~2016-01-05 15:29 UTC|newest]

Thread overview: 46+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2016-01-05 15:28 [patch added to the 3.12 stable tree] ipv6: fix tunnel error handling Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] MIPS: KVM: Fix ASID restoration logic Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] MIPS: KVM: Fix CACHE immediate offset sign extension Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] MIPS: KVM: Uninit VCPU in vcpu_create error path Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] unix: avoid use-after-free in ep_remove_wait_queue Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] packet: do skb_probe_transport_header when we actually have data Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] packet: infer protocol from ethernet header if unset Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] sctp: translate host order to network order when setting a hmacid Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] snmp: Remove duplicate OUTMCAST stat increment Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] net: qmi_wwan: add XS Stick W100-2 from 4G Systems Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] tcp: md5: fix lockdep annotation Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] tcp: initialize tp->copied_seq in case of cross SYN connection Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] net, scm: fix PaX detected msg_controllen overflow in scm_detach_fds Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] net: ipmr: fix static mfc/dev leaks on table destruction Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] net: ip6mr: " Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] broadcom: fix PHY_ID_BCM5481 entry in the id table Jiri Slaby
2016-01-05 15:28 ` Jiri Slaby [this message]
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] ipv6: add complete rcu protection around np->opt Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] net/neighbour: fix crash at dumping device-agnostic proxy entries Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] ipv6: sctp: implement sctp_v6_destroy_sock() Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] Bluetooth: ath3k: Add support of 04ca:300d AR3012 device Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] ARM: 8426/1: dma-mapping: add missing range check in dma_mmap() Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] ARM: 8427/1: dma-mapping: add support for offset parameter " Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] ARM: common: edma: Fix channel parameter for irq callbacks Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] x86/setup: Extend low identity map to cover whole kernel range Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] x86/setup: Fix low identity map for >= 2GB " Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] x86/cpu: Call verify_cpu() after having entered long mode too Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] x86/cpu: Fix SMAP check in PVOPS environments Jiri Slaby
2016-01-05 15:28 ` Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] mac80211: fix driver RSSI event calculations Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] net: mvneta: Fix CPU_MAP registers initialisation Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] mwifiex: fix mwifiex_rdeeprom_read() Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] staging: rtl8712: Add device ID for Sitecom WLA2100 Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] Bluetooth: hidp: fix device disconnect on idle timeout Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] Bluetooth: ath3k: Add new AR3012 0930:021c id Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] Bluetooth: ath3k: Add support of AR3012 0cf3:817b device Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] can: sja1000: clear interrupts on start Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] arm64: Fix compat register mappings Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] usblp: do not set TASK_INTERRUPTIBLE before lock Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] usb: musb: core: fix order of arguments to ulpi write callback Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] USB: ti_usb_3410_5052: Add Honeywell HGI80 ID Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] USB: serial: option: add support for Novatel MiFi USB620L Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] USB: option: add XS Stick W100-2 from 4G Systems Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] ALSA: usb-audio: add packet size quirk for the Medeli DD305 Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] ALSA: usb-audio: prevent CH345 multiport output SysEx corruption Jiri Slaby
2016-01-05 15:28 ` [patch added to the 3.12 stable tree] ALSA: usb-audio: work around CH345 input " Jiri Slaby

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1452007726-3747-17-git-send-email-jslaby@suse.cz \
    --to=jslaby@suse.cz \
    --cc=davem@davemloft.net \
    --cc=mkubecek@suse.cz \
    --cc=stable@vger.kernel.org \
    --subject='Re: [patch added to the 3.12 stable tree] ipv6: distinguish frag queues by device for multicast and link-local packets' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.