* [PATCH v3 net 1/2] net/sched: act_vlan: Push skb->data to mac_header prior calling skb_vlan_*() functions
@ 2016-09-29 9:10 Shmulik Ladkani
2016-09-29 9:10 ` [PATCH v3 net 2/2] net: skbuff: Limit skb_vlan_pop/push() to expect skb->data at mac header Shmulik Ladkani
` (2 more replies)
0 siblings, 3 replies; 5+ messages in thread
From: Shmulik Ladkani @ 2016-09-29 9:10 UTC (permalink / raw)
To: David S . Miller
Cc: netdev, Jamal Hadi Salim, Shmulik Ladkani, Daniel Borkmann,
Pravin Shelar, Jiri Pirko
Generic skb_vlan_push/skb_vlan_pop functions don't properly handle the
case where the input skb data pointer does not point at the mac header:
- They're doing push/pop, but fail to properly unwind data back to its
original location.
For example, in the skb_vlan_push case, any subsequent
'skb_push(skb, skb->mac_len)' calls make the skb->data point 4 bytes
BEFORE start of frame, leading to bogus frames that may be transmitted.
- They update rcsum per the added/removed 4 bytes tag.
Alas if data is originally after the vlan/eth headers, then these
bytes were already pulled out of the csum.
OTOH calling skb_vlan_push/skb_vlan_pop with skb->data at mac_header
present no issues.
act_vlan is the only caller to skb_vlan_*() that has skb->data pointing
at network header (upon ingress).
Other calles (ovs, bpf) already adjust skb->data at mac_header.
This patch fixes act_vlan to point to the mac_header prior calling
skb_vlan_*() functions, as other callers do.
Signed-off-by: Shmulik Ladkani <shmulik.ladkani@gmail.com>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Pravin Shelar <pshelar@ovn.org>
Cc: Jiri Pirko <jiri@mellanox.com>
---
net/sched/act_vlan.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/net/sched/act_vlan.c b/net/sched/act_vlan.c
index 691409de3e..4ffc6c13a5 100644
--- a/net/sched/act_vlan.c
+++ b/net/sched/act_vlan.c
@@ -36,6 +36,12 @@ static int tcf_vlan(struct sk_buff *skb, const struct tc_action *a,
bstats_update(&v->tcf_bstats, skb);
action = v->tcf_action;
+ /* Ensure 'data' points at mac_header prior calling vlan manipulating
+ * functions.
+ */
+ if (skb_at_tc_ingress(skb))
+ skb_push_rcsum(skb, skb->mac_len);
+
switch (v->tcfv_action) {
case TCA_VLAN_ACT_POP:
err = skb_vlan_pop(skb);
@@ -57,6 +63,9 @@ drop:
action = TC_ACT_SHOT;
v->tcf_qstats.drops++;
unlock:
+ if (skb_at_tc_ingress(skb))
+ skb_pull_rcsum(skb, skb->mac_len);
+
spin_unlock(&v->tcf_lock);
return action;
}
--
2.7.4
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH v3 net 2/2] net: skbuff: Limit skb_vlan_pop/push() to expect skb->data at mac header
2016-09-29 9:10 [PATCH v3 net 1/2] net/sched: act_vlan: Push skb->data to mac_header prior calling skb_vlan_*() functions Shmulik Ladkani
@ 2016-09-29 9:10 ` Shmulik Ladkani
2016-10-04 1:42 ` David Miller
2016-09-29 9:20 ` [PATCH v3 net 1/2] net/sched: act_vlan: Push skb->data to mac_header prior calling skb_vlan_*() functions Shmulik Ladkani
2016-10-04 1:42 ` David Miller
2 siblings, 1 reply; 5+ messages in thread
From: Shmulik Ladkani @ 2016-09-29 9:10 UTC (permalink / raw)
To: David S . Miller
Cc: netdev, Jamal Hadi Salim, Shmulik Ladkani, Daniel Borkmann,
Pravin Shelar, Jiri Pirko
skb_vlan_pop/push were too generic, trying to support the cases where
skb->data is at mac header, and cases where skb->data is arbitrarily
elsewhere.
Supporting an arbitrary skb->data was complex and bogus:
- It failed to unwind skb->data to its original location post actual
pop/push.
(Also, semantic is not well defined for unwinding: If data was into
the eth header, need to use same offset from start; But if data was
at network header or beyond, need to adjust the original offset
according to the push/pull)
- It mangled the rcsum post actual push/pop, without taking into account
that the eth bytes might already have been pulled out of the csum.
Most callers (ovs, bpf) already had their skb->data at mac_header upon
invoking skb_vlan_pop/push.
Last caller that failed to do so (act_vlan) has been recently fixed.
Therefore, to simplify things, no longer support arbitrary skb->data
inputs for skb_vlan_pop/push().
skb->data is expected to be exactly at mac_header; WARN otherwise.
Signed-off-by: Shmulik Ladkani <shmulik.ladkani@gmail.com>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Pravin Shelar <pshelar@ovn.org>
Cc: Jiri Pirko <jiri@mellanox.com>
---
v3: Instead of correcting unwinding of skb->data in skb_vlan_pop/push,
just kill the support for arbitraray skb->data inputs, and assume
given skb->data always points at mac_header.
Fix act_vlan, the sole user not adehering to this assumption.
v2: Instead of reducing mac_len by 4 bytes, which was found incorrect,
fix the problem of wrong unwinding of 'skb->data'
net/core/skbuff.c | 37 ++++++++++++++++++++++---------------
1 file changed, 22 insertions(+), 15 deletions(-)
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 3864b4b68f..8c38263cdf 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -4478,13 +4478,18 @@ EXPORT_SYMBOL(skb_ensure_writable);
static int __skb_vlan_pop(struct sk_buff *skb, u16 *vlan_tci)
{
struct vlan_hdr *vhdr;
- unsigned int offset = skb->data - skb_mac_header(skb);
+ int offset = skb->data - skb_mac_header(skb);
int err;
- __skb_push(skb, offset);
+ if (WARN_ONCE(offset,
+ "__skb_vlan_pop got skb with skb->data not at mac header (offset %d)\n",
+ offset)) {
+ return -EINVAL;
+ }
+
err = skb_ensure_writable(skb, VLAN_ETH_HLEN);
if (unlikely(err))
- goto pull;
+ return err;
skb_postpull_rcsum(skb, skb->data + (2 * ETH_ALEN), VLAN_HLEN);
@@ -4501,12 +4506,13 @@ static int __skb_vlan_pop(struct sk_buff *skb, u16 *vlan_tci)
skb_set_network_header(skb, ETH_HLEN);
skb_reset_mac_len(skb);
-pull:
- __skb_pull(skb, offset);
return err;
}
+/* Pop a vlan tag either from hwaccel or from payload.
+ * Expects skb->data at mac header.
+ */
int skb_vlan_pop(struct sk_buff *skb)
{
u16 vlan_tci;
@@ -4541,29 +4547,30 @@ int skb_vlan_pop(struct sk_buff *skb)
}
EXPORT_SYMBOL(skb_vlan_pop);
+/* Push a vlan tag either into hwaccel or into payload (if hwaccel tag present).
+ * Expects skb->data at mac header.
+ */
int skb_vlan_push(struct sk_buff *skb, __be16 vlan_proto, u16 vlan_tci)
{
if (skb_vlan_tag_present(skb)) {
- unsigned int offset = skb->data - skb_mac_header(skb);
+ int offset = skb->data - skb_mac_header(skb);
int err;
- /* __vlan_insert_tag expect skb->data pointing to mac header.
- * So change skb->data before calling it and change back to
- * original position later
- */
- __skb_push(skb, offset);
+ if (WARN_ONCE(offset,
+ "skb_vlan_push got skb with skb->data not at mac header (offset %d)\n",
+ offset)) {
+ return -EINVAL;
+ }
+
err = __vlan_insert_tag(skb, skb->vlan_proto,
skb_vlan_tag_get(skb));
- if (err) {
- __skb_pull(skb, offset);
+ if (err)
return err;
- }
skb->protocol = skb->vlan_proto;
skb->mac_len += VLAN_HLEN;
skb_postpush_rcsum(skb, skb->data + (2 * ETH_ALEN), VLAN_HLEN);
- __skb_pull(skb, offset);
}
__vlan_hwaccel_put_tag(skb, vlan_proto, vlan_tci);
return 0;
--
2.7.4
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH v3 net 1/2] net/sched: act_vlan: Push skb->data to mac_header prior calling skb_vlan_*() functions
2016-09-29 9:10 [PATCH v3 net 1/2] net/sched: act_vlan: Push skb->data to mac_header prior calling skb_vlan_*() functions Shmulik Ladkani
2016-09-29 9:10 ` [PATCH v3 net 2/2] net: skbuff: Limit skb_vlan_pop/push() to expect skb->data at mac header Shmulik Ladkani
@ 2016-09-29 9:20 ` Shmulik Ladkani
2016-10-04 1:42 ` David Miller
2 siblings, 0 replies; 5+ messages in thread
From: Shmulik Ladkani @ 2016-09-29 9:20 UTC (permalink / raw)
To: David S . Miller
Cc: netdev, Jamal Hadi Salim, Daniel Borkmann, Pravin Shelar, Jiri Pirko
David,
On Thu, 29 Sep 2016 12:10:40 +0300 Shmulik Ladkani <shmulik.ladkani@gmail.com> wrote:
> This patch fixes act_vlan to point to the mac_header prior calling
> skb_vlan_*() functions, as other callers do.
>
This 1/2 patch fixes the problem detailed in [1] for act_vlan,
last known caller of skb_vlan_*() with skb->data not at mac_header.
I think it's a good candidate for -stable; it fixes the observed bug and
it is rather focused.
Subsequent 2/2 patch hermetically seals the future possibility that one
might call skb_vlan_*() with skb->data not at mac_header.
This might go to stable as well, but not strictly required.
Thanks,
Shmulik
[1] https://patchwork.ozlabs.org/patch/676111/
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v3 net 1/2] net/sched: act_vlan: Push skb->data to mac_header prior calling skb_vlan_*() functions
2016-09-29 9:10 [PATCH v3 net 1/2] net/sched: act_vlan: Push skb->data to mac_header prior calling skb_vlan_*() functions Shmulik Ladkani
2016-09-29 9:10 ` [PATCH v3 net 2/2] net: skbuff: Limit skb_vlan_pop/push() to expect skb->data at mac header Shmulik Ladkani
2016-09-29 9:20 ` [PATCH v3 net 1/2] net/sched: act_vlan: Push skb->data to mac_header prior calling skb_vlan_*() functions Shmulik Ladkani
@ 2016-10-04 1:42 ` David Miller
2 siblings, 0 replies; 5+ messages in thread
From: David Miller @ 2016-10-04 1:42 UTC (permalink / raw)
To: shmulik.ladkani; +Cc: netdev, jhs, daniel, pshelar, jiri
From: Shmulik Ladkani <shmulik.ladkani@gmail.com>
Date: Thu, 29 Sep 2016 12:10:40 +0300
> Generic skb_vlan_push/skb_vlan_pop functions don't properly handle the
> case where the input skb data pointer does not point at the mac header:
>
> - They're doing push/pop, but fail to properly unwind data back to its
> original location.
> For example, in the skb_vlan_push case, any subsequent
> 'skb_push(skb, skb->mac_len)' calls make the skb->data point 4 bytes
> BEFORE start of frame, leading to bogus frames that may be transmitted.
>
> - They update rcsum per the added/removed 4 bytes tag.
> Alas if data is originally after the vlan/eth headers, then these
> bytes were already pulled out of the csum.
>
> OTOH calling skb_vlan_push/skb_vlan_pop with skb->data at mac_header
> present no issues.
>
> act_vlan is the only caller to skb_vlan_*() that has skb->data pointing
> at network header (upon ingress).
> Other calles (ovs, bpf) already adjust skb->data at mac_header.
>
> This patch fixes act_vlan to point to the mac_header prior calling
> skb_vlan_*() functions, as other callers do.
>
> Signed-off-by: Shmulik Ladkani <shmulik.ladkani@gmail.com>
Applied and queued up for -stable.
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v3 net 2/2] net: skbuff: Limit skb_vlan_pop/push() to expect skb->data at mac header
2016-09-29 9:10 ` [PATCH v3 net 2/2] net: skbuff: Limit skb_vlan_pop/push() to expect skb->data at mac header Shmulik Ladkani
@ 2016-10-04 1:42 ` David Miller
0 siblings, 0 replies; 5+ messages in thread
From: David Miller @ 2016-10-04 1:42 UTC (permalink / raw)
To: shmulik.ladkani; +Cc: netdev, jhs, daniel, pshelar, jiri
From: Shmulik Ladkani <shmulik.ladkani@gmail.com>
Date: Thu, 29 Sep 2016 12:10:41 +0300
> skb_vlan_pop/push were too generic, trying to support the cases where
> skb->data is at mac header, and cases where skb->data is arbitrarily
> elsewhere.
>
> Supporting an arbitrary skb->data was complex and bogus:
> - It failed to unwind skb->data to its original location post actual
> pop/push.
> (Also, semantic is not well defined for unwinding: If data was into
> the eth header, need to use same offset from start; But if data was
> at network header or beyond, need to adjust the original offset
> according to the push/pull)
> - It mangled the rcsum post actual push/pop, without taking into account
> that the eth bytes might already have been pulled out of the csum.
>
> Most callers (ovs, bpf) already had their skb->data at mac_header upon
> invoking skb_vlan_pop/push.
> Last caller that failed to do so (act_vlan) has been recently fixed.
>
> Therefore, to simplify things, no longer support arbitrary skb->data
> inputs for skb_vlan_pop/push().
>
> skb->data is expected to be exactly at mac_header; WARN otherwise.
>
> Signed-off-by: Shmulik Ladkani <shmulik.ladkani@gmail.com>
Applied.
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2016-10-04 1:42 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-09-29 9:10 [PATCH v3 net 1/2] net/sched: act_vlan: Push skb->data to mac_header prior calling skb_vlan_*() functions Shmulik Ladkani
2016-09-29 9:10 ` [PATCH v3 net 2/2] net: skbuff: Limit skb_vlan_pop/push() to expect skb->data at mac header Shmulik Ladkani
2016-10-04 1:42 ` David Miller
2016-09-29 9:20 ` [PATCH v3 net 1/2] net/sched: act_vlan: Push skb->data to mac_header prior calling skb_vlan_*() functions Shmulik Ladkani
2016-10-04 1:42 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.