Eric Dumazet wrote:
> OVS actions like pop_eth followed by pop_mpls(ETH_P_TEB) or pop_nsh
> can expose an inner Ethernet header which is not in the linear part
> of the skb. Output to an internal port then crashes in eth_type_trans():
>
> flow: in_port(0),eth(),eth_type(0x8847),mpls(lse=0x00010140)
> actions: pop_eth,pop_mpls(0x6558),0
> # AF_PACKET SOCK_RAW on dp0: eth / mpls / eth / 4096 bytes of payload
>
> kernel BUG at include/linux/skbuff.h:2839!
> RIP: 0010:eth_type_trans (include/linux/etherdevice.h:635
> net/ethernet/eth.c:163)
> Call Trace:
> internal_dev_recv (net/openvswitch/vport-internal_dev.c:202) openvswitch
> do_execute_actions (net/openvswitch/actions.c:1296) openvswitch
> ovs_execute_actions (net/openvswitch/actions.c:1606) openvswitch
> ovs_dp_process_packet (net/openvswitch/datapath.c:310) openvswitch
> ovs_vport_receive (net/openvswitch/vport.c:448) openvswitch
> internal_dev_xmit (net/openvswitch/vport-internal_dev.c:42) openvswitch
> dev_hard_start_xmit (include/linux/netdevice.h:5455
> include/linux/netdevice.h:5464 net/core/dev.c:4057 net/core/dev.c:4073)
> __dev_queue_xmit (net/core/dev.c:5066)
> packet_sendmsg (net/packet/af_packet.c:3157 net/packet/af_packet.c:3189)
>
> Use eth_type_trans_careful(), and drop the packet if the Ethernet
> header can not be pulled. This covers all OVS actions at the consumer,
> instead of fixing each producer.
>
> Fixes: b2d0f5d5dc53 ("openvswitch: enable NSH support")
> Fixes: f66b53fdbb22 ("openvswitch: New MPLS actions for layer 2 tunnelling")
> Signed-off-by: Eric Dumazet <[email protected]>
> Reviewed-by: Aaron Conole <[email protected]>
> Reviewed-by: Jamal Hadi Salim <[email protected]>
> Tested-by: Jamal Hadi Salim <[email protected]>
Reviewed-by: Willem de Bruijn <[email protected]>
_______________________________________________
dev mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
