linux-kernel - [PATCH v4 net 0/2] net: vlan: fix skb_panic bug in vlan_dev_hard

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20260126040426.2570396-1-chenzhen126@huawei.com>
Date: Mon, 26 Jan 2026 12:04:24 +0800
From: Chen Zhen <chenzhen126@...wei.com>
To: <davem@...emloft.net>, <edumazet@...gle.com>, <kuba@...nel.org>,
	<pabeni@...hat.com>, <horms@...nel.org>
CC: <netdev@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
	<huyizhen2@...wei.com>, <gaoxingwang1@...wei.com>
Subject: [PATCH v4 net 0/2] net: vlan: fix skb_panic bug in vlan_dev_hard_header()

This series fix a skb_panic bug in vlan_dev_hard_header().

If a vlan device with reorder_hdr off is created without hw offload
feature, but up with hw offload on, the ndisc skb has no enough
room for vlan hdr in vlan_dev_hard_header() and finally panic.

The first patch fixes the bug itself by always set hard_header_len with
VLAN_HLEN. The second patch adds a regression test for this bug.

---
v3 -> v4:
- Change the fix method to cover other callers as suggested by Eric, thx!
- v3: https://lore.kernel.org/all/20260112075939.2509397-1-chenzhen126@huawei.com/

v2 -> v3:
- Add a comment to test script to silence shellcheck SC2329 warning
- v2: https://lore.kernel.org/all/20260107033423.1885071-1-chenzhen126@huawei.com/

v1 -> v2:
- Address format issues of commit message
- Add a selftest to catch re-occurrence of this issue as suggested by Jakub
- v1: https://lore.kernel.org/all/20251231035419.23422-1-chenzhen126@huawei.com/

Chen Zhen (2):
  net: vlan: always set hard_header_len with VLAN_HLEN
  selftests: vlan: add test for turn on hw offload with reorder_hdr off

 net/8021q/vlan.c                              |  5 ---
 net/8021q/vlan_dev.c                          |  8 ++---
 tools/testing/selftests/net/Makefile          |  1 +
 .../testing/selftests/net/vlan_hw_offload.sh  | 31 +++++++++++++++++++
 4 files changed, 35 insertions(+), 10 deletions(-)
 create mode 100755 tools/testing/selftests/net/vlan_hw_offload.sh

-- 
2.33.0