Re: [PATCH v3 net,stable] tun: fix vlan packet truncation

2018-04-18 Thread David Miller
From: Bjørn Mork 
Date: Tue, 17 Apr 2018 22:46:38 +0200

> Bogus trimming in tun_net_xmit() causes truncated vlan packets.
> 
> skb->len is correct whether or not skb_vlan_tag_present() is true. There
> is no more reason to adjust the skb length on xmit in this driver than
> any other driver. tun_put_user() adds 4 bytes to the total for tagged
> packets because it transmits the tag inline to userspace.  This is
> similar to a nic transmitting the tag inline on the wire.
> 
> Reproducing the bug by sending any tagged packet through back-to-back
> connected tap interfaces:
 ...
> Fixes: aff3d70a07ff ("tun: allow to attach ebpf socket filter")
> Cc: Jason Wang 
> Signed-off-by: Bjørn Mork 

Applied and queued up for -stable, thanks.


Re: [PATCH v3 net,stable] tun: fix vlan packet truncation

2018-04-17 Thread Jason Wang



On 2018年04月18日 04:46, Bjørn Mork wrote:

Bogus trimming in tun_net_xmit() causes truncated vlan packets.

skb->len is correct whether or not skb_vlan_tag_present() is true. There
is no more reason to adjust the skb length on xmit in this driver than
any other driver. tun_put_user() adds 4 bytes to the total for tagged
packets because it transmits the tag inline to userspace.  This is
similar to a nic transmitting the tag inline on the wire.

Reproducing the bug by sending any tagged packet through back-to-back
connected tap interfaces:

  socat TUN,tun-type=tap,iff-up,tun-name=in TUN,tun-type=tap,iff-up,tun-name=out 
&
  ip link add link in name in.20 type vlan id 20
  ip addr add 10.9.9.9/24 dev in.20
  ip link set in.20 up
  tshark -nxxi in -f arp -c1 2>/dev/null &
  tshark -nxxi out -f arp -c1 2>/dev/null &
  ping -c 1 10.9.9.5 >/dev/null 2>&1

The output from the 'in' and 'out' interfaces are different when the
bug is present:

  Capturing on 'in'
    ff ff ff ff ff ff 76 cf 76 37 d5 0a 81 00 00 14   ..v.v7..
  0010  08 06 00 01 08 00 06 04 00 01 76 cf 76 37 d5 0a   ..v.v7..
  0020  0a 09 09 09 00 00 00 00 00 00 0a 09 09 05 ..

  Capturing on 'out'
    ff ff ff ff ff ff 76 cf 76 37 d5 0a 81 00 00 14   ..v.v7..
  0010  08 06 00 01 08 00 06 04 00 01 76 cf 76 37 d5 0a   ..v.v7..
  0020  0a 09 09 09 00 00 00 00 00 00 ..

Fixes: aff3d70a07ff ("tun: allow to attach ebpf socket filter")
Cc: Jason Wang 
Signed-off-by: Bjørn Mork 
---
v2:
  - Must still call pskb_trim() after running the filter, as pointed out by
Jason and David. But no need to check if len < 0 anymore, since
run_ebpf_filter() returns insigned ints.

v3:
  - actually change the len <= 0 test as mentioned above


  drivers/net/tun.c | 7 +--
  1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 28583aa0c17d..ef33950a45d9 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1102,12 +1102,7 @@ static netdev_tx_t tun_net_xmit(struct sk_buff *skb, 
struct net_device *dev)
goto drop;
  
  	len = run_ebpf_filter(tun, skb, len);

-
-   /* Trim extra bytes since we may insert vlan proto & TCI
-* in tun_put_user().
-*/
-   len -= skb_vlan_tag_present(skb) ? sizeof(struct veth) : 0;
-   if (len <= 0 || pskb_trim(skb, len))
+   if (len == 0 || pskb_trim(skb, len))
goto drop;
  
  	if (unlikely(skb_orphan_frags_rx(skb, GFP_ATOMIC)))


Acked-by: Jason Wang 

Thanks


[PATCH v3 net,stable] tun: fix vlan packet truncation

2018-04-17 Thread Bjørn Mork
Bogus trimming in tun_net_xmit() causes truncated vlan packets.

skb->len is correct whether or not skb_vlan_tag_present() is true. There
is no more reason to adjust the skb length on xmit in this driver than
any other driver. tun_put_user() adds 4 bytes to the total for tagged
packets because it transmits the tag inline to userspace.  This is
similar to a nic transmitting the tag inline on the wire.

Reproducing the bug by sending any tagged packet through back-to-back
connected tap interfaces:

 socat TUN,tun-type=tap,iff-up,tun-name=in TUN,tun-type=tap,iff-up,tun-name=out 
&
 ip link add link in name in.20 type vlan id 20
 ip addr add 10.9.9.9/24 dev in.20
 ip link set in.20 up
 tshark -nxxi in -f arp -c1 2>/dev/null &
 tshark -nxxi out -f arp -c1 2>/dev/null &
 ping -c 1 10.9.9.5 >/dev/null 2>&1

The output from the 'in' and 'out' interfaces are different when the
bug is present:

 Capturing on 'in'
   ff ff ff ff ff ff 76 cf 76 37 d5 0a 81 00 00 14   ..v.v7..
 0010  08 06 00 01 08 00 06 04 00 01 76 cf 76 37 d5 0a   ..v.v7..
 0020  0a 09 09 09 00 00 00 00 00 00 0a 09 09 05 ..

 Capturing on 'out'
   ff ff ff ff ff ff 76 cf 76 37 d5 0a 81 00 00 14   ..v.v7..
 0010  08 06 00 01 08 00 06 04 00 01 76 cf 76 37 d5 0a   ..v.v7..
 0020  0a 09 09 09 00 00 00 00 00 00 ..

Fixes: aff3d70a07ff ("tun: allow to attach ebpf socket filter")
Cc: Jason Wang 
Signed-off-by: Bjørn Mork 
---
v2:
 - Must still call pskb_trim() after running the filter, as pointed out by
   Jason and David. But no need to check if len < 0 anymore, since
   run_ebpf_filter() returns insigned ints.

v3:
 - actually change the len <= 0 test as mentioned above


 drivers/net/tun.c | 7 +--
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 28583aa0c17d..ef33950a45d9 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1102,12 +1102,7 @@ static netdev_tx_t tun_net_xmit(struct sk_buff *skb, 
struct net_device *dev)
goto drop;
 
len = run_ebpf_filter(tun, skb, len);
-
-   /* Trim extra bytes since we may insert vlan proto & TCI
-* in tun_put_user().
-*/
-   len -= skb_vlan_tag_present(skb) ? sizeof(struct veth) : 0;
-   if (len <= 0 || pskb_trim(skb, len))
+   if (len == 0 || pskb_trim(skb, len))
goto drop;
 
if (unlikely(skb_orphan_frags_rx(skb, GFP_ATOMIC)))
-- 
2.11.0