netdev - Re: [PATCH v3 net 1/2] net/sched: act_vlan: Push skb->data to mac_header prior calling skb_vlan

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20161003.214224.2063102101117168185.davem@davemloft.net>
Date:   Mon, 03 Oct 2016 21:42:24 -0400 (EDT)
From:   David Miller <davem@...emloft.net>
To:     shmulik.ladkani@...il.com
Cc:     netdev@...r.kernel.org, jhs@...atatu.com, daniel@...earbox.net,
        pshelar@....org, jiri@...lanox.com
Subject: Re: [PATCH v3 net 1/2] net/sched: act_vlan: Push skb->data to
 mac_header prior calling skb_vlan_*() functions

From: Shmulik Ladkani <shmulik.ladkani@...il.com>
Date: Thu, 29 Sep 2016 12:10:40 +0300

> Generic skb_vlan_push/skb_vlan_pop functions don't properly handle the
> case where the input skb data pointer does not point at the mac header:
> 
> - They're doing push/pop, but fail to properly unwind data back to its
>   original location.
>   For example, in the skb_vlan_push case, any subsequent
>   'skb_push(skb, skb->mac_len)' calls make the skb->data point 4 bytes
>   BEFORE start of frame, leading to bogus frames that may be transmitted.
> 
> - They update rcsum per the added/removed 4 bytes tag.
>   Alas if data is originally after the vlan/eth headers, then these
>   bytes were already pulled out of the csum.
> 
> OTOH calling skb_vlan_push/skb_vlan_pop with skb->data at mac_header
> present no issues.
> 
> act_vlan is the only caller to skb_vlan_*() that has skb->data pointing
> at network header (upon ingress).
> Other calles (ovs, bpf) already adjust skb->data at mac_header.
> 
> This patch fixes act_vlan to point to the mac_header prior calling
> skb_vlan_*() functions, as other callers do.
> 
> Signed-off-by: Shmulik Ladkani <shmulik.ladkani@...il.com>

Applied and queued up for -stable.