netdev - Re: [PATCH net-next 01/18] net: skb_scrub_packet(): Scrub offload_fwd

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 19 Nov 2018 11:07:45 -0800 (PST)
From:   David Miller <davem@...emloft.net>
To:     idosch@...lanox.com
Cc:     netdev@...r.kernel.org, linux-kselftest@...r.kernel.org,
        shuah@...nel.org, jiri@...lanox.com, petrm@...lanox.com,
        roopa@...ulusnetworks.com, mlxsw@...lanox.com
Subject: Re: [PATCH net-next 01/18] net: skb_scrub_packet(): Scrub
 offload_fwd_mark

From: Ido Schimmel <idosch@...lanox.com>
Date: Mon, 19 Nov 2018 16:11:07 +0000

> From: Petr Machata <petrm@...lanox.com>
> 
> When a packet is trapped and the corresponding SKB marked as
> already-forwarded, it retains this marking even after it is forwarded
> across veth links into another bridge. There, since it ingresses the
> bridge over veth, which doesn't have offload_fwd_mark, it triggers a
> warning in nbp_switchdev_frame_mark().
> 
> Then nbp_switchdev_allowed_egress() decides not to allow egress from
> this bridge through another veth, because the SKB is already marked, and
> the mark (of 0) of course matches. Thus the packet is incorrectly
> blocked.
> 
> Solve by resetting offload_fwd_mark() in skb_scrub_packet(). That
> function is called from tunnels and also from veth, and thus catches the
> cases where traffic is forwarded between bridges and transformed in a
> way that invalidates the marking.
> 
> Signed-off-by: Petr Machata <petrm@...lanox.com>
> Suggested-by: Ido Schimmel <idosch@...lanox.com>
> Signed-off-by: Ido Schimmel <idosch@...lanox.com>

As a bug fix this seems relevant for 'net' instead of 'net-next'.