Re: [Bridge] [PATCH net v2] net: bridge: fix stale eth hdr pointer in br_dev_xmit

2020-02-24 Thread David Miller
From: Nikolay Aleksandrov Date: Mon, 24 Feb 2020 18:46:22 +0200 > In br_dev_xmit() we perform vlan filtering in br_allowed_ingress() but > if the packet has the vlan header inside (e.g. bridge with disabled > tx-vlan-offload) then the vlan filtering code will use skb_vlan_untag() > to extract

Re: [Bridge] [PATCH net v2] net: bridge: fix stale eth hdr pointer in br_dev_xmit

2020-02-24 Thread Stephen Hemminger
On Mon, 24 Feb 2020 18:46:22 +0200 Nikolay Aleksandrov wrote: > - eth = eth_hdr(skb); > skb_pull(skb, ETH_HLEN) you could just swap these two lines.

Re: [Bridge] [PATCH net v2] net: bridge: fix stale eth hdr pointer in br_dev_xmit

2020-02-24 Thread nikolay
On 24 February 2020 18:54:27 EET, Stephen Hemminger wrote: >On Mon, 24 Feb 2020 18:46:22 +0200 >Nikolay Aleksandrov wrote: > >> -eth = eth_hdr(skb); >> skb_pull(skb, ETH_HLEN) > >you could just swap these two lines. Can't, still caching the wrong mac_header offset.

[Bridge] [PATCH net v2] net: bridge: fix stale eth hdr pointer in br_dev_xmit

2020-02-24 Thread Nikolay Aleksandrov
In br_dev_xmit() we perform vlan filtering in br_allowed_ingress() but if the packet has the vlan header inside (e.g. bridge with disabled tx-vlan-offload) then the vlan filtering code will use skb_vlan_untag() to extract the vid before filtering which in turn calls pskb_may_pull() and we may end

Re: [Bridge] [PATCH net] net: bridge: fix stale eth hdr pointer in br_dev_xmit

2020-02-24 Thread Nikolay Aleksandrov
On 24/02/2020 15:07, Nikolay Aleksandrov wrote: > In br_dev_xmit() we perform vlan filtering in br_allowed_ingress() but > if the packet has the vlan header inside (e.g. bridge with disabled > tx-vlan-offload) then the vlan filtering code will use skb_vlan_untag() > to extract the vid before

[Bridge] [PATCH net] net: bridge: fix stale eth hdr pointer in br_dev_xmit

2020-02-24 Thread Nikolay Aleksandrov
In br_dev_xmit() we perform vlan filtering in br_allowed_ingress() but if the packet has the vlan header inside (e.g. bridge with disabled tx-vlan-offload) then the vlan filtering code will use skb_vlan_untag() to extract the vid before filtering which in turn calls pskb_may_pull() and we may end

Re: [Bridge] KMSAN: uninit-value in br_dev_xmit

2020-02-24 Thread Nikolay Aleksandrov
On 24/02/2020 10:38, syzbot wrote: > Hello, > > syzbot found the following crash on: > > HEAD commit:8bbbc5cf kmsan: don't compile memmove > git tree: https://github.com/google/kmsan.git master > console output: https://syzkaller.appspot.com/x/log.txt?x=14d9a3d9e0 > kernel config: