tc egress actions can leave an skb with fewer than ETH_HLEN bytes in
its linear part. loopback_xmit() then crashes in eth_type_trans():
tc qdisc add dev lo clsact
tc filter add dev lo egress matchall action vlan pop_eth
# AF_PACKET SOCK_RAW: eth / eth / 8192 bytes of payload
kernel BUG at include/linux/skbuff.h:2839!
RIP: 0010:eth_type_trans (include/linux/etherdevice.h:635
net/ethernet/eth.c:163)
Call Trace:
loopback_xmit (drivers/net/loopback.c:87)
dev_hard_start_xmit (include/linux/netdevice.h:5455
include/linux/netdevice.h:5464 net/core/dev.c:4057 net/core/dev.c:4073)
__dev_queue_xmit (net/core/dev.c:5066)
packet_sendmsg (net/packet/af_packet.c:3157 net/packet/af_packet.c:3189)
The same happens with "action ife decode" on lo egress.
Use eth_type_trans_careful(), and drop the packet if the Ethernet
header can not be pulled.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Vega <[email protected]>
Link: https://lore.kernel.org/netdev/[email protected]/
Signed-off-by: Eric Dumazet <[email protected]>
---
drivers/net/loopback.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/net/loopback.c b/drivers/net/loopback.c
index
55ecd5ebac0f21b61b64373c429a6f9ba5d15c8e..8a6cb34e6b5f02c88dfb0c6bf112068c4f51fec1
100644
--- a/drivers/net/loopback.c
+++ b/drivers/net/loopback.c
@@ -70,6 +70,7 @@ EXPORT_SYMBOL(blackhole_netdev);
static netdev_tx_t loopback_xmit(struct sk_buff *skb,
struct net_device *dev)
{
+ enum skb_drop_reason reason;
int len;
skb_tx_timestamp(skb);
@@ -84,7 +85,12 @@ static netdev_tx_t loopback_xmit(struct sk_buff *skb,
*/
skb_dst_force(skb);
- skb->protocol = eth_type_trans(skb, dev);
+ reason = eth_type_trans_careful(skb, dev);
+ if (unlikely(reason)) {
+ dev_core_stats_tx_dropped_inc(dev);
+ kfree_skb_reason(skb, reason);
+ return NETDEV_TX_OK;
+ }
len = skb->len;
if (likely(__netif_rx(skb) == NET_RX_SUCCESS))
--
2.53.0
_______________________________________________
dev mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
