netdev - Re: [PATCH net] net: skb_scrub_packet(): Scrub offload_fwd

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 21 Nov 2018 15:40:24 -0800 (PST)
From:   David Miller <davem@...emloft.net>
To:     petrm@...lanox.com
Cc:     netdev@...r.kernel.org, idosch@...lanox.com
Subject: Re: [PATCH net] net: skb_scrub_packet(): Scrub offload_fwd_mark

From: Petr Machata <petrm@...lanox.com>
Date: Tue, 20 Nov 2018 11:39:56 +0000

> When a packet is trapped and the corresponding SKB marked as
> already-forwarded, it retains this marking even after it is forwarded
> across veth links into another bridge. There, since it ingresses the
> bridge over veth, which doesn't have offload_fwd_mark, it triggers a
> warning in nbp_switchdev_frame_mark().
> 
> Then nbp_switchdev_allowed_egress() decides not to allow egress from
> this bridge through another veth, because the SKB is already marked, and
> the mark (of 0) of course matches. Thus the packet is incorrectly
> blocked.
> 
> Solve by resetting offload_fwd_mark() in skb_scrub_packet(). That
> function is called from tunnels and also from veth, and thus catches the
> cases where traffic is forwarded between bridges and transformed in a
> way that invalidates the marking.
> 
> Fixes: 6bc506b4fb06 ("bridge: switchdev: Add forward mark support for stacked devices")
> Fixes: abf4bb6b63d0 ("skbuff: Add the offload_mr_fwd_mark field")
> Signed-off-by: Petr Machata <petrm@...lanox.com>
> Suggested-by: Ido Schimmel <idosch@...lanox.com>

Applied and queued up for -stable, thanks.