Commit f39acc84 authored Sep 29, 2016 by Shmulik Ladkani Committed by David S. Miller Oct 03, 2016

net/sched: act_vlan: Push skb->data to mac_header prior calling skb_vlan_*() functions



Generic skb_vlan_push/skb_vlan_pop functions don't properly handle the
case where the input skb data pointer does not point at the mac header:

- They're doing push/pop, but fail to properly unwind data back to its
  original location.
  For example, in the skb_vlan_push case, any subsequent
  'skb_push(skb, skb->mac_len)' calls make the skb->data point 4 bytes
  BEFORE start of frame, leading to bogus frames that may be transmitted.

- They update rcsum per the added/removed 4 bytes tag.
  Alas if data is originally after the vlan/eth headers, then these
  bytes were already pulled out of the csum.

OTOH calling skb_vlan_push/skb_vlan_pop with skb->data at mac_header
present no issues.

act_vlan is the only caller to skb_vlan_*() that has skb->data pointing
at network header (upon ingress).
Other calles (ovs, bpf) already adjust skb->data at mac_header.

This patch fixes act_vlan to point to the mac_header prior calling
skb_vlan_*() functions, as other callers do.

Signed-off-by: Shmulik Ladkani <shmulik.ladkani@gmail.com>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Pravin Shelar <pshelar@ovn.org>
Cc: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent f814bfd7

net/sched/act_vlan.c

+9 −0

Original line number	Diff line number	Diff line
		@@ -37,6 +37,12 @@ static int tcf_vlan(struct sk_buff skb, const struct tc_action a,
		bstats_update(&v->tcf_bstats, skb);
		action = v->tcf_action;

		/* Ensure 'data' points at mac_header prior calling vlan manipulating
		* functions.
		*/
		if (skb_at_tc_ingress(skb))
		skb_push_rcsum(skb, skb->mac_len);

		switch (v->tcfv_action) {
		case TCA_VLAN_ACT_POP:
		err = skb_vlan_pop(skb);
		@@ -83,6 +89,9 @@ drop:
		action = TC_ACT_SHOT;
		v->tcf_qstats.drops++;
		unlock:
		if (skb_at_tc_ingress(skb))
		skb_pull_rcsum(skb, skb->mac_len);

		spin_unlock(&v->tcf_lock);
		return action;
		}

Admin message