Jamal Hadi Salim <[email protected]> writes: > The issue: > pop_mpls() restores MAC_PROTO_ETHERNET when the popped ethertype is > ETH_P_TEB, but skb_mpls_pop() only guarantees that the MPLS shim is in > the linear area. When the inner Ethernet header sits in a page > fragment, the datapath now claims an Ethernet header it cannot access > linearly. > > Output to an OVS internal vport then calls eth_type_trans(), which > pulls ETH_HLEN from an empty linear area and triggers the BUG in > __skb_pull(): > > kernel BUG at ./include/linux/skbuff.h:2830! > RIP: 0010:eth_type_trans+0x335/0x500 > internal_dev_recv > ovs_vport_send > do_output > do_execute_actions > ovs_execute_actions > ovs_dp_process_packet > ovs_vport_receive > internal_dev_xmit > > Conditions to recreate the bug: > On a system with 4 KiB pages and CONFIG_OPENVSWITCH and CONFIG_PACKET > enabled, use CAP_NET_ADMIN to create an OVS datapath and bring its local > internal port up with MTU 9000. Install a flow matching an Ethernet/MPLS > packet with one bottom-of-stack label and actions pop_eth, > pop_mpls(0x6558), output to the local port. With CAP_NET_RAW, send a > 4128-byte AF_PACKET/SOCK_RAW frame containing outer Ethernet, the MPLS > label, inner Ethernet and 4096 payload bytes. The two pops consume the > linear headers and expose the inner Ethernet header in page fragments. > > The Fix: > Pull the inner Ethernet header into the linear area before restoring > MAC_PROTO_ETHERNET. > > Fixes: f66b53fdbb22 ("openvswitch: New MPLS actions for layer 2 tunnelling") > Link: > https://lore.kernel.org/netdev/[email protected]/ > Cc: [email protected] > Reviewed-by: Ilya Maximets <[email protected]> > Reviewed-by: Eric Dumazet <[email protected]> > Signed-off-by: Jamal Hadi Salim <[email protected]> > ---
Reviewed-by: Aaron Conole <[email protected]> _______________________________________________ dev mailing list [email protected] https://mail.openvswitch.org/mailman/listinfo/ovs-dev
