Commit 5146d1f1 authored by Bernie Harris's avatar Bernie Harris Committed by David S. Miller
Browse files

tunnel: Clear IPCB(skb)->opt before dst_link_failure called 



IPCB may contain data from previous layers (in the observed case the
qdisc layer). In the observed scenario, the data was misinterpreted as
ip header options, which later caused the ihl to be set to an invalid
value (<5). This resulted in an infinite loop in the mips implementation
of ip_fast_csum.

This patch clears IPCB(skb)->opt before dst_link_failure can be called for
various types of tunnels. This change only applies to encapsulated ipv4
packets.

The code introduced in 11c21a30 which clears all of IPCB has been removed
to be consistent with these changes, and instead the opt field is cleared
unconditionally in ip_tunnel_xmit. The change in ip_tunnel_xmit applies to
SIT, GRE, and IPIP tunnels.

The relevant vti, l2tp, and pptp functions already contain similar code for
clearing the IPCB.

Signed-off-by: default avatarBernie Harris <bernie.harris@alliedtelesis.co.nz>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 9bdfb3b7

net/ipv4/ip_tunnel.c

+2 −1
Original line number Diff line number Diff line
@@ -661,6 +661,8 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, 
	inner_iph = (const struct iphdr *)skb_inner_network_header(skb);

	connected = (tunnel->parms.iph.daddr != 0);



	memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));



	dst = tnl_params->daddr;

	if (dst == 0) {

		/* NBMA tunnel */
@@ -758,7 +760,6 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, 
				tunnel->err_time + IPTUNNEL_ERR_TIMEO)) {

			tunnel->err_count--;



			memset(IPCB(skb), 0, sizeof(*IPCB(skb)));

			dst_link_failure(skb);

		} else

			tunnel->err_count = 0;

net/ipv4/udp_tunnel.c

+2 −0
Original line number Diff line number Diff line
@@ -89,6 +89,8 @@ void udp_tunnel_xmit_skb(struct rtable *rt, struct sock *sk, struct sk_buff *skb 
	uh->source = src_port;

	uh->len = htons(skb->len);



	memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));



	udp_set_csum(nocheck, skb, src, dst, skb->len);



	iptunnel_xmit(sk, rt, skb, src, dst, IPPROTO_UDP, tos, ttl, df, xnet);

net/ipv6/ip6_gre.c

+2 −0
Original line number Diff line number Diff line
@@ -777,6 +777,8 @@ static inline int ip6gre_xmit_ipv4(struct sk_buff *skb, struct net_device *dev) 
	__u32 mtu;

	int err;



	memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));



	if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))

		encap_limit = t->parms.encap_limit;

net/ipv6/ip6_tunnel.c

+2 −0
Original line number Diff line number Diff line
@@ -1180,6 +1180,8 @@ ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev) 
	u8 tproto;

	int err;



	memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));



	tproto = ACCESS_ONCE(t->parms.proto);

	if (tproto != IPPROTO_IPIP && tproto != 0)

		return -1;

CRA Git | Maintained and supported by SUSTech CRA and CCSE