linux-kernel - [PATCH] flow_dissector: Fix vlan header offset in __skb_flow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 20 Jun 2019 00:01:32 +0800
From:   YueHaibing <yuehaibing@...wei.com>
To:     <davem@...emloft.net>, <sdf@...gle.com>, <jianbol@...lanox.com>,
        <jiri@...lanox.com>, <mirq-linux@...e.qmqm.pl>,
        <willemb@...gle.com>
CC:     <linux-kernel@...r.kernel.org>, <netdev@...r.kernel.org>,
        YueHaibing <yuehaibing@...wei.com>
Subject: [PATCH] flow_dissector: Fix vlan header offset in __skb_flow_dissect

We build vlan on top of bonding interface, which vlan offload
is off, bond mode is 802.3ad (LACP) and xmit_hash_policy is
BOND_XMIT_POLICY_ENCAP34.

__skb_flow_dissect() fails to get information from protocol headers
encapsulated within vlan, because 'nhoff' is points to IP header,
so bond hashing is based on layer 2 info, which fails to distribute
packets across slaves.

Fixes: d5709f7ab776 ("flow_dissector: For stripped vlan, get vlan info from skb->vlan_tci")
Signed-off-by: YueHaibing <yuehaibing@...wei.com>
---
 net/core/flow_dissector.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 415b95f..2a52abb 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -785,6 +785,9 @@ bool __skb_flow_dissect(const struct sk_buff *skb,
 		    skb && skb_vlan_tag_present(skb)) {
 			proto = skb->protocol;
 		} else {
+			if (dissector_vlan == FLOW_DISSECTOR_KEY_MAX)
+				nhoff -=  sizeof(*vlan);
+
 			vlan = __skb_header_pointer(skb, nhoff, sizeof(_vlan),
 						    data, hlen, &_vlan);
 			if (!vlan) {
-- 
2.7.0