An skb sent to a RedBox interlink can share data with master delivery
or the original TX skb. hsr_deliver_master() and hsr_xmit() then write
different source addresses, so one consumer can observe the other's
address.
Use skb_cow() before interlink address substitution when those paths
can share the data. Drop that egress on COW failure. Other interlink
traffic keeps its zero-copy behavior.
Fixes: 5055cccfc2d1 ("net: hsr: Provide RedBox support (HSR-SAN)")
Reviewed-by: Ali Ahmet Memis <[email protected]>
Tested-by: Ali Ahmet Memis <[email protected]>
Signed-off-by: Xin Xie <[email protected]>
---
net/hsr/hsr_forward.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/net/hsr/hsr_forward.c b/net/hsr/hsr_forward.c
index 0774981a65c1..67aaf5a8622b 100644
--- a/net/hsr/hsr_forward.c
+++ b/net/hsr/hsr_forward.c
@@ -420,6 +420,22 @@ static void hsr_deliver_master(struct sk_buff *skb, struct
net_device *dev,
static int hsr_xmit(struct sk_buff *skb, struct hsr_port *port,
struct hsr_frame_info *frame)
{
+ /* An interlink-bound skb from get_untagged_frame() can still alias
+ * another live consumer: for master-originated frames the clone
+ * shares the original TX skb (which taps or the TX path may still
+ * hold); for ring frames the master also consumes them when they
+ * are destined to the local node without being exclusive to it.
+ * Privatize before any address mutation.
+ */
+ if (port->type == HSR_PT_INTERLINK &&
+ (frame->port_rcv->type == HSR_PT_MASTER ||
+ (frame->is_local_dest && !frame->is_local_exclusive)) &&
+ skb_cow(skb, 0)) {
+ frame->port_rcv->dev->stats.rx_dropped++;
+ kfree_skb(skb);
+ return NET_XMIT_DROP;
+ }
+
if (frame->port_rcv->type == HSR_PT_MASTER) {
hsr_addr_subst_dest(frame->node_src, skb, port);
--
2.43.0
