This series fixes a class of producer/consumer bugs in which an outer
header is popped and the packet is then handed to a consumer with fewer
than ETH_HLEN bytes in the linear area. eth_type_trans() pulls ETH_HLEN
from that area and can BUG in __skb_pull() when the inner Ethernet header
is not linear. The affected producers are act_vlan POP_ETH, act_mpls POP,
act_ife egress decode, and the Open vSwitch MPLS/TEB and NSH pops. A
consumer-side guard in act_mirred rejects redirecting a headerless packet
to a device that expects a link-layer header.
Patch 1 makes act_vlan POP_ETH pull the inner Ethernet header after the
pop and drop only when the packet is genuinely shorter than ETH_HLEN.
Patch 2 does the same for act_mpls, gated on the pre-pop MAC length.
Patch 3 adds the act_mirred guard at the redirect boundary. Patch 4
keeps act_ife egress decode from consuming the inner Ethernet header and
restores the header metadata.
Patches 5 and 6 establish the same linear-header invariant for the OVS
MPLS/TEB and NSH pops before restoring MAC_PROTO_ETHERNET.
Changes in v2:
- Pull the inner header with pskb_may_pull(skb, ETH_HLEN) and drop only
on failure, instead of dropping on the post-pop skb_headlen() check
which may drop frags (Eric/Willem).
- act_mpls: gate the pull on the pre-pop mac_len and remove the separate
was_mpls state.
- Drop the v1 TUN patch; add the act_mirred consumer-side guard.
- Add the act_ife egress decode fix; decode is receive-side, and the
egress path restores the frame for loopback-style transmit paths.
- Keep the OVS TEB and NSH patches unchanged and restore their v1
Reviewed-by trailers.
- Drop two bouncing Cc addresses.
Jamal Hadi Salim (6):
net/sched: act_vlan: pull the inner Ethernet header after POP_ETH
net/sched: act_mpls: pull the inner Ethernet header after POP
net/sched: act_mirred: reject redirects without a link-layer header
net/sched: act_ife: do not consume the inner header on egress
net: openvswitch: ensure a linear inner Ethernet header on TEB pop
net: openvswitch: ensure a linear inner Ethernet header on NSH pop
net/openvswitch/actions.c | 12 +++++++++---
net/sched/act_ife.c | 4 ++++
net/sched/act_mirred.c | 7 +++++++
net/sched/act_mpls.c | 2 ++
net/sched/act_vlan.c | 2 ++
5 files changed, 24 insertions(+), 3 deletions(-)
--
2.43.0
_______________________________________________
dev mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
