• Shmulik Ladkani's avatar
    net/sched: act_vlan: Push skb->data to mac_header prior calling skb_vlan_*() functions · f39acc84
    Shmulik Ladkani authored
    Generic skb_vlan_push/skb_vlan_pop functions don't properly handle the
    case where the input skb data pointer does not point at the mac header:
    
    - They're doing push/pop, but fail to properly unwind data back to its
      original location.
      For example, in the skb_vlan_push case, any subsequent
      'skb_push(skb, skb->mac_len)' calls make the skb->data point 4 bytes
      BEFORE start of frame, leading to bogus frames that may be transmitted.
    
    - They update rcsum per the added/removed 4 bytes tag.
      Alas if data is originally after the vlan/eth headers, then these
      bytes were already pulled out of the csum.
    
    OTOH calling skb_vlan_push/skb_vlan_pop with skb->data at mac_header
    present no issues.
    
    act_vlan is the only caller to skb_vlan_*() that has skb->data pointing
    at network header (upon ingress).
    Other calles (ovs, bpf) already adjust skb->data at mac_header.
    
    This patch fixes act_vlan to point to the mac_header prior calling
    skb_vlan_*() functions, as other callers do.
    Signed-off-by: default avatarShmulik Ladkani <shmulik.ladkani@gmail.com>
    Cc: Daniel Borkmann <daniel@iogearbox.net>
    Cc: Pravin Shelar <pshelar@ovn.org>
    Cc: Jiri Pirko <jiri@mellanox.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    f39acc84
act_vlan.c 7.19 KB