linux-kernel - Re: [PATCH 3.4 077/176] net: Fix stacked vlan offload features computation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 10 Apr 2015 09:49:58 +0900
From:	Toshiaki Makita <makita.toshiaki@....ntt.co.jp>
To:	lizf@...nel.org, stable@...r.kernel.org
CC:	linux-kernel@...r.kernel.org,
	"David S. Miller" <davem@...emloft.net>,
	Zefan Li <lizefan@...wei.com>
Subject: Re: [PATCH 3.4 077/176] net: Fix stacked vlan offload features computation

On 2015/04/09 17:45, lizf@...nel.org wrote:
> From: Toshiaki Makita <makita.toshiaki@....ntt.co.jp>
> 
> 3.4.107-rc1 review patch.  If anyone has any objections, please let me know.
> 
> ------------------
> 
> 
> commit 796f2da81bead71ffc91ef70912cd8d1827bf756 upstream.
> 
> When vlan tags are stacked, it is very likely that the outer tag is stored
> in skb->vlan_tci and skb->protocol shows the inner tag's vlan_proto.
> Currently netif_skb_features() first looks at skb->protocol even if there
> is the outer tag in vlan_tci, thus it incorrectly retrieves the protocol
> encapsulated by the inner vlan instead of the inner vlan protocol.
> This allows GSO packets to be passed to HW and they end up being
> corrupted.
> 
> Fixes: 58e998c6d239 ("offloading: Force software GSO for multiple vlan tags.")
> Signed-off-by: Toshiaki Makita <makita.toshiaki@....ntt.co.jp>
> Signed-off-by: David S. Miller <davem@...emloft.net>
> [lizf: Backported to 3.4:
>  - remove ETH_P_8021AD
>  - pass protocol to harmonize_features()]
> Signed-off-by: Zefan Li <lizefan@...wei.com>
> ---
>  net/core/dev.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/net/core/dev.c b/net/core/dev.c
> index 0770364..f783dd3 100644
> --- a/net/core/dev.c
> +++ b/net/core/dev.c
> @@ -2149,6 +2149,14 @@ netdev_features_t netif_skb_features(struct sk_buff *skb)
>  	} else if (!vlan_tx_tag_present(skb)) {
>  		return harmonize_features(skb, protocol, features);
>  	}
> +	if (!vlan_tx_tag_present(skb)) {
> +		if (unlikely(protocol == htons(ETH_P_8021Q))) {
> +			struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data;
> +			protocol = veh->h_vlan_encapsulated_proto;
> +		} else {
> +			return harmonize_features(skb, protocol, features);
> +		}
> +        }

This does not look like a correct fix.
We need to replace the existing check rather than add a new check, like
this:
https://lkml.org/lkml/2015/2/16/649

Thanks,
Toshiaki Makita

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/