netdev - Re: [PATCH net] net-gro: reset skb->pkt_type in napi_reuse

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Sat, 17 Nov 2018 21:55:21 -0800
From:   Eric Dumazet <eric.dumazet@...il.com>
To:     Eric Dumazet <edumazet@...gle.com>,
        "David S . Miller" <davem@...emloft.net>
Cc:     netdev <netdev@...r.kernel.org>,
        Eric Dumazet <eric.dumazet@...il.com>
Subject: Re: [PATCH net] net-gro: reset skb->pkt_type in napi_reuse_skb()



On 11/17/2018 09:51 PM, Eric Dumazet wrote:
> eth_type_trans() assumes initial value for skb->pkt_type
> is PACKET_HOST.
> 
> This is indeed the value right after a fresh skb allocation.
> 
> However, it is possible that GRO merged a packet with a different
> value (like PACKET_OTHERHOST in case macvlan is used), so
> we need to make sure napi->skb will have pkt_type set back to
> PACKET_HOST.
> 
> Otherwise, valid packets might be dropped by the stack because
> their pkt_type is not PACKET_HOST.
> 
> napi_reuse_skb() was added in commit 96e93eab2033 ("gro: Add
> internal interfaces for VLAN"), but this bug always has
> been there.
> 
> Fixes: 96e93eab2033 ("gro: Add internal interfaces for VLAN")
> Signed-off-by: Eric Dumazet <edumazet@...gle.com>
> ---
>  net/core/dev.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/net/core/dev.c b/net/core/dev.c
> index 0ffcbdd55fa9ee545c807f2ed3fc178830e3075a..689ff83af855660f8b9aaa0266b5e509cd0839cb 100644
> --- a/net/core/dev.c
> +++ b/net/core/dev.c
> @@ -5655,6 +5655,11 @@ static void napi_reuse_skb(struct napi_struct *napi, struct sk_buff *skb)
>  	skb->vlan_tci = 0;
>  	skb->dev = napi->dev;
>  	skb->skb_iif = 0;
> +
> +	/* eth_type_trans() assumes pkt_type is PACKET_HOST */

> +	WARN_ON_ONCE(skb->pkt_type != PACKET_HOST);

Oops sorry for this bit, I will send a v2 without it of course.


> +	skb->pkt_type = PACKET_HOST;
> +
>  	skb->encapsulation = 0;
>  	skb_shinfo(skb)->gso_type = 0;
>  	skb->truesize = SKB_TRUESIZE(skb_end_offset(skb));
>