netdev - Re: TX_RING and VLAN : (packet size is too long 1518

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 23 Feb 2014 14:58:13 +0100
From:	Daniel Borkmann <dborkman@...hat.com>
To:	Mathias Kretschmer <mathias.kretschmer@...us.fraunhofer.de>
CC:	jbrouer@...hat.com, netdev@...r.kernel.org
Subject: Re: TX_RING and VLAN : (packet size is too long 1518 > 1514)

On 02/23/2014 12:03 PM, Mathias Kretschmer wrote:
> Hi Daniel, all
>
> we're running into the above error when sending full-sized VLAN-tagged frames via TX_RING (Kernel 3.10.31, but same code seems to be present in 3.14).
>
> For the regular send() calls, there seems to be code in place to handle VLAN-tagged frames, but in tpacket_fill_skb() there is no such check.
>
> I came up with fix for this, but can only verify this tomorrow.
> If it works, I'd send you a patch, but someone with more insights into the networking code should probably fix this properly ;-)

Looks like the logic was added only to packet_snd() path when there was no TX_RING
implementation available yet.

Does that patch work for you?

diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 48a6a93..9deb991 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2257,8 +2257,7 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
  	if (unlikely(!(dev->flags & IFF_UP)))
  		goto out_put;

-	reserve = dev->hard_header_len;
-
+	reserve = dev->hard_header_len + VLAN_HLEN;
  	size_max = po->tx_ring.frame_size
  		- (po->tp_hdrlen - sizeof(struct sockaddr_ll));

@@ -2285,8 +2284,7 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
  			goto out_status;

  		tp_len = tpacket_fill_skb(po, skb, ph, dev, size_max, proto,
-				addr, hlen);
-
+					  addr, hlen);
  		if (unlikely(tp_len < 0)) {
  			if (po->tp_loss) {
  				__packet_set_status(po, ph,
@@ -2300,6 +2298,21 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
  				goto out_status;
  			}
  		}
+		if (tp_len > (dev->mtu + dev->hard_header_len)) {
+			struct ethhdr *ehdr;
+			/* Earlier code assumed this would be a VLAN pkt,
+			 * double-check this now that we have the actual
+			 * packet in hand.
+			 */
+
+			skb_reset_mac_header(skb);
+			ehdr = eth_hdr(skb);
+			if (ehdr->h_proto != htons(ETH_P_8021Q)) {
+				status = TP_STATUS_WRONG_FORMAT;
+				err = -EMSGSIZE;
+				goto out_status;
+			}
+		}

  		packet_pick_tx_queue(dev, skb);

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html