Eric Dumazet wrote:
> tc egress actions can leave an skb with fewer than ETH_HLEN bytes in
> its linear part. loopback_xmit() then crashes in eth_type_trans():
>
> tc qdisc add dev lo clsact
> tc filter add dev lo egress matchall action vlan pop_eth
> # AF_PACKET SOCK_RAW: eth / eth / 8192 bytes of payload
>
> kernel BUG at include/linux/skbuff.h:2839!
> RIP: 0010:eth_type_trans (include/linux/etherdevice.h:635
> net/ethernet/eth.c:163)
> Call Trace:
> loopback_xmit (drivers/net/loopback.c:87)
> dev_hard_start_xmit (include/linux/netdevice.h:5455
> include/linux/netdevice.h:5464 net/core/dev.c:4057 net/core/dev.c:4073)
> __dev_queue_xmit (net/core/dev.c:5066)
> packet_sendmsg (net/packet/af_packet.c:3157 net/packet/af_packet.c:3189)
>
> The same happens with "action ife decode" on lo egress.
>
> Use eth_type_trans_careful(), and drop the packet if the Ethernet
> header can not be pulled.
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Reported-by: Vega <[email protected]>
> Link: https://lore.kernel.org/netdev/[email protected]/
> Signed-off-by: Eric Dumazet <[email protected]>
> Reviewed-by: Jamal Hadi Salim <[email protected]>
> Tested-by: Jamal Hadi Salim <[email protected]>
Reviewed-by: Willem de Bruijn <[email protected]>
_______________________________________________
dev mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
