* [PATCH] Signed-off-by: Peter Kosyh <p.kosyh@gmail.com>
@ 2019-07-18 10:26 Peter Kosyh
0 siblings, 0 replies; 4+ messages in thread
From: Peter Kosyh @ 2019-07-18 10:26 UTC (permalink / raw)
To: p.kosyh; +Cc: davem, David Ahern, Shrijeet Mukherjee, netdev, linux-kernel
vrf_process_v4_outbound() and vrf_process_v6_outbound() do routing
using ip/ipv6 addresses, but don't make sure the header is available in
skb->data[] (skb_headlen() is less then header size).
The situation may occures while forwarding from MPLS layer to vrf, for example.
So, patch adds pskb_may_pull() calls in is_ip_tx_frame(), just before call
to vrf_process_... functions.
Signed-off-by: Peter Kosyh <p.kosyh@gmail.com>
---
drivers/net/vrf.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
index 54edf8956a25..7c0200bc46f9 100644
--- a/drivers/net/vrf.c
+++ b/drivers/net/vrf.c
@@ -292,13 +292,16 @@ static netdev_tx_t is_ip_tx_frame(struct sk_buff *skb, struct net_device *dev)
{
switch (skb->protocol) {
case htons(ETH_P_IP):
+ if (!pskb_may_pull(skb, ETH_HLEN + sizeof(struct iphdr)))
+ break;
return vrf_process_v4_outbound(skb, dev);
case htons(ETH_P_IPV6):
+ if (!pskb_may_pull(skb, ETH_HLEN + sizeof(struct ipv6hdr)))
+ break;
return vrf_process_v6_outbound(skb, dev);
- default:
- vrf_tx_error(dev, skb);
- return NET_XMIT_DROP;
}
+ vrf_tx_error(dev, skb);
+ return NET_XMIT_DROP;
}
static netdev_tx_t vrf_xmit(struct sk_buff *skb, struct net_device *dev)
--
2.11.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] Signed-off-by: Peter Kosyh <p.kosyh@gmail.com>
2019-07-18 14:02 ` David Ahern
@ 2019-07-18 18:44 ` David Miller
0 siblings, 0 replies; 4+ messages in thread
From: David Miller @ 2019-07-18 18:44 UTC (permalink / raw)
To: dsa; +Cc: p.kosyh, shrijeet, netdev, linux-kernel
From: David Ahern <dsa@cumulusnetworks.com>
Date: Thu, 18 Jul 2019 08:02:45 -0600
> your subject line needs a proper Subject - a one-line summary of the
> change starting with 'vrf:'. See examples from 'git log drivers/net/vrf.c'
Indeed, you really need to fix this even for your second submission as it
had the same exact problem.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] Signed-off-by: Peter Kosyh <p.kosyh@gmail.com>
2019-07-18 9:41 Peter Kosyh
@ 2019-07-18 14:02 ` David Ahern
2019-07-18 18:44 ` David Miller
0 siblings, 1 reply; 4+ messages in thread
From: David Ahern @ 2019-07-18 14:02 UTC (permalink / raw)
To: Peter Kosyh; +Cc: davem, Shrijeet Mukherjee, netdev, linux-kernel
your subject line needs a proper Subject - a one-line summary of the
change starting with 'vrf:'. See examples from 'git log drivers/net/vrf.c'
On 7/18/19 3:41 AM, Peter Kosyh wrote:
> vrf_process_v4_outbound() and vrf_process_v6_outbound() do routing
> using ip/ipv6 addresses, but don't make sure the header is available in
> skb->data[] (skb_headlen() is less then header size).
>
> The situation may occures while forwarding from MPLS layer to vrf, for
> example.
so the use case is a label pop with the nexthop as the VRF device?
>
> So, this patch adds pskb_may_pull() calls in is_ip_tx_frame(), just before
> call to vrf_process_... functions.
>
> Signed-off-by: Peter Kosyh <p.kosyh@gmail.com>
> ---
> drivers/net/vrf.c | 9 ++++++---
> 1 file changed, 6 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
> index 54edf8956a25..d552f29a58d1 100644
> --- a/drivers/net/vrf.c
> +++ b/drivers/net/vrf.c
> @@ -292,13 +292,16 @@ static netdev_tx_t is_ip_tx_frame(struct sk_buff *skb, struct net_device *dev)
> {
> switch (skb->protocol) {
> case htons(ETH_P_IP):
> + if (!pskb_may_pull(skb, ETH_HLEN + sizeof(struct iphdr))
> + break;
that check goes in vrf_process_v4_outbound.
> return vrf_process_v4_outbound(skb, dev);
> case htons(ETH_P_IPV6):
> + if (!pskb_may_pull(skb, ETH_HLEN + sizeof(struct ipv6hdr))
> + break;
that check goes in vrf_process_v6_outbound
leave this higher level sorter untouched.
> return vrf_process_v6_outbound(skb, dev);
> - default:
> - vrf_tx_error(dev, skb);
> - return NET_XMIT_DROP;
> }
> + vrf_tx_error(dev, skb);
> + return NET_XMIT_DROP;
> }
>
> static netdev_tx_t vrf_xmit(struct sk_buff *skb, struct net_device *dev)
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH] Signed-off-by: Peter Kosyh <p.kosyh@gmail.com>
@ 2019-07-18 9:41 Peter Kosyh
2019-07-18 14:02 ` David Ahern
0 siblings, 1 reply; 4+ messages in thread
From: Peter Kosyh @ 2019-07-18 9:41 UTC (permalink / raw)
To: p.kosyh; +Cc: davem, David Ahern, Shrijeet Mukherjee, netdev, linux-kernel
vrf_process_v4_outbound() and vrf_process_v6_outbound() do routing
using ip/ipv6 addresses, but don't make sure the header is available in
skb->data[] (skb_headlen() is less then header size).
The situation may occures while forwarding from MPLS layer to vrf, for
example.
So, this patch adds pskb_may_pull() calls in is_ip_tx_frame(), just before
call to vrf_process_... functions.
Signed-off-by: Peter Kosyh <p.kosyh@gmail.com>
---
drivers/net/vrf.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
index 54edf8956a25..d552f29a58d1 100644
--- a/drivers/net/vrf.c
+++ b/drivers/net/vrf.c
@@ -292,13 +292,16 @@ static netdev_tx_t is_ip_tx_frame(struct sk_buff *skb, struct net_device *dev)
{
switch (skb->protocol) {
case htons(ETH_P_IP):
+ if (!pskb_may_pull(skb, ETH_HLEN + sizeof(struct iphdr))
+ break;
return vrf_process_v4_outbound(skb, dev);
case htons(ETH_P_IPV6):
+ if (!pskb_may_pull(skb, ETH_HLEN + sizeof(struct ipv6hdr))
+ break;
return vrf_process_v6_outbound(skb, dev);
- default:
- vrf_tx_error(dev, skb);
- return NET_XMIT_DROP;
}
+ vrf_tx_error(dev, skb);
+ return NET_XMIT_DROP;
}
static netdev_tx_t vrf_xmit(struct sk_buff *skb, struct net_device *dev)
--
2.11.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
end of thread, other threads:[~2019-07-18 18:44 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-07-18 10:26 [PATCH] Signed-off-by: Peter Kosyh <p.kosyh@gmail.com> Peter Kosyh
-- strict thread matches above, loose matches on Subject: below --
2019-07-18 9:41 Peter Kosyh
2019-07-18 14:02 ` David Ahern
2019-07-18 18:44 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).