netdev - Re: [PATCH net v2 2/2] net: ethernet: cortina: Bypass checksumming engine of alien ethertypes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CANn89iKfqZaqL02GigqwypwD7xKxKbiJMWvJsiPigzNBMPYtDA@mail.gmail.com>
Date: Tue, 19 Dec 2023 10:14:59 +0100
From: Eric Dumazet <edumazet@...gle.com>
To: Linus Walleij <linus.walleij@...aro.org>
Cc: Hans Ulli Kroll <ulli.kroll@...glemail.com>, "David S. Miller" <davem@...emloft.net>, 
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, netdev@...r.kernel.org
Subject: Re: [PATCH net v2 2/2] net: ethernet: cortina: Bypass checksumming
 engine of alien ethertypes

On Tue, Dec 19, 2023 at 12:42 AM Linus Walleij <linus.walleij@...aro.org> wrote:
>
> On Mon, Dec 18, 2023 at 3:50 PM Eric Dumazet <edumazet@...gle.com> wrote:
> > On Sat, Dec 16, 2023 at 8:36 PM Linus Walleij <linus.walleij@...aro.org> wrote:
>
> > > +       /* Dig out the the ethertype actually in the buffer and not what the
> > > +        * protocol claims to be. This is the raw data that the checksumming
> > > +        * offload engine will have to deal with.
> > > +        */
> > > +       p = (__be16 *)(skb->data + 2 * ETH_ALEN);
> > > +       ethertype = ntohs(*p);
> > > +       if (ethertype == ETH_P_8021Q) {
> > > +               p += 2; /* +2 sizeof(__be16) */
> > > +               ethertype = ntohs(*p);
> > > +       }
> >
> > Presumably all you need is to call vlan_get_protocol() ?
>
> Sadly no. As the comment says: we want the ethertype that is actually in the
> skb, not what is in skb->protocol, and the code in vlan_get_protocol() just
> trusts skb->protocol to be the ethertype in the frame, especially if vlan
> is not used.
>
> This is often what we want: DSA switches will "wash" custom ethertypes
> before they go out, but in this case the custom ethertype upsets the
> ethernet checksum engine used as conduit interface toward the DSA
> switch.

 Problem is that your code misses skb_header_pointer() or
pskb_may_pull() call...
Second "ethertype = ntohs(*p);" might access uninitialized data.

If this is a common operation, perhaps use a common helper from all drivers,
this would help code review a bit...