This series fixes a class of producer/consumer bugs in which an outer
header is popped and the packet is then handed to a consumer with fewer
than ETH_HLEN bytes in the linear area. eth_type_trans() pulls ETH_HLEN
from that area and can BUG in __skb_pull() when the inner Ethernet header
is not linear. The affected producers are act_vlan POP_ETH, act_mpls POP,
act_ife egress decode, and the Open vSwitch MPLS/TEB and NSH pops. A
consumer-side guard in act_mirred ensures a pullable link-layer header at
the redirect boundary.
Patch 1 makes act_vlan POP_ETH pull the inner Ethernet header after the
pop and drop only when the packet is genuinely shorter than ETH_HLEN.
Patch 2 does the same for act_mpls when the configured inner protocol is
ETH_P_TEB. Other inner protocols are not required to carry an Ethernet
header. Patch 3 ensures a pullable link-layer header at the redirect
boundary. Patch 4 keeps act_ife egress
decode from consuming the inner Ethernet header and restores the header
metadata.
Patches 5 and 6 establish the same linear-header invariant for the OVS
MPLS/TEB and NSH pops before restoring MAC_PROTO_ETHERNET.
Changes in v3:
- act_vlan: keep the unconditional post-pop pskb_may_pull(ETH_HLEN).
After discussion with Willem I considered vetting it on ETH_P_TEB,
but was hesitant because i felt checking TEB in act_vlan was
in bad taste: POP_ETH has no inner-protocol parameter. Eyeballing
also showed the TEB test is not needed for the eth_type_trans()
failure this series fixes (of course sashikos will have something
to say;->).
- act_mpls: drop the pre-pop mac_len gate and pull ETH_HLEN only for
ETH_P_TEB. Other act_mpls inner protocols are not required to carry
an Ethernet header (Willem de Bruijn).
- act_mirred: drop the skb_network_offset() condition and keep only
pskb_may_pull(dev->min_header_len). The offset check rejected valid
MPLS L2VPN redirects (Eric Dumazet; tc_mpls_l2vpn.sh).
- act_vlan and act_ife: no code change; add Eric Dumazet's Reviewed-by.
- OVS TEB and NSH: no code change; add Aaron Conole's Reviewed-by.
Changes in v2:
- Pull the inner header with pskb_may_pull(skb, ETH_HLEN) and drop only
on failure, instead of dropping on the post-pop skb_headlen() check
which may drop frags (Eric/Willem).
- act_mpls: gate the pull on the pre-pop mac_len and remove the separate
was_mpls state.
- Drop the v1 TUN patch; add the act_mirred consumer-side guard.
- Add the act_ife egress decode fix; decode is receive-side, and the
egress path restores the frame for loopback-style transmit paths.
- Keep the OVS TEB and NSH patches unchanged and restore their v1
Reviewed-by trailers.
- Drop two bouncing Cc addresses.
Jamal Hadi Salim (6):
net/sched: act_vlan: pull the inner Ethernet header after POP_ETH
net/sched: act_mpls: pull the inner Ethernet header after POP
net/sched: act_mirred: ensure a pullable link-layer header before redirect
net/sched: act_ife: do not consume the inner header on egress
net: openvswitch: ensure a linear inner Ethernet header on TEB pop
net: openvswitch: ensure a linear inner Ethernet header on NSH pop
net/openvswitch/actions.c | 12 +++++++++---
net/sched/act_ife.c | 4 ++++
net/sched/act_mirred.c | 6 ++++++
net/sched/act_mpls.c | 3 +++
net/sched/act_vlan.c | 2 ++
5 files changed, 24 insertions(+), 3 deletions(-)
--
2.43.0
_______________________________________________
dev mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
