From: Hangbin Liu liuhangbin@gmail.com
[ Upstream commit dfed913e8b55a0c2c4906f1242fd38fd9a116e49 ]
Before the blammed commit, the kernel drops GSO VLAN tagged packet if it's created with socket(AF_PACKET, SOCK_RAW, 0) plus virtio_net_hdr. The reason is AF_PACKET doesn't adjust the skb network header if there is a VLAN tag. Then after virtio_net_hdr_set_proto() called, the skb->protocol will be set to ETH_P_IP/IPv6. And in later inet/ipv6_gso_segment() the skb is dropped as network header position is invalid.
The blammed commit introduces a kernel BUG in __skb_gso_segment for AF_PACKET SOCK_RAW GSO VLAN tagged packets. What happens is that virtio_net_hdr_set_proto() exists early as skb->protocol is already set to ETH_P_ALL. Then in packet_parse_headers() skb->protocol is set to ETH_P_8021AD, but neither the network header position is adjusted, nor the mac header is pulled. Thus when we get to validate the xmit skb and enter skb_mac_gso_segment(), skb->mac_len has value 14, but vlan_depth gets updated to 18 after skb_network_protocol() is called. This causes the BUG_ON from __skb_pull(skb, vlan_depth) to be hit, as the mac header has not been pulled yet.
Let's handle VLAN packets by adjusting network header position in packet_parse_headers(). The adjustment is safe and does not affect the later xmit as tap device also did that. The mac header pull is handled in a following commit: commit e9d3f80935b6 ("net/af_packet: make sure to pull mac header")
In packet_snd(), packet_parse_headers() need to be moved before calling virtio_net_hdr_set_proto(), so we can set correct skb->protocol and network header first.
There is no need to update tpacket_snd() as it calls packet_parse_headers() in tpacket_fill_skb(), which is already before calling virtio_net_hdr_* functions.
skb->no_fcs setting is also moved upper to make all skb settings together and keep consistency with function packet_sendmsg_spkt().
Cc: stable@vger.kernel.org # 5.4+ Fixes: 1ed1d5921139 ("net: skip virtio_net_hdr_set_proto if protocol already set") Reported-by: syzbot+3d91b8dbbcf515400e92@syzkaller.appspotmail.com Signed-off-by: Hangbin Liu liuhangbin@gmail.com Acked-by: Willem de Bruijn willemb@google.com Acked-by: Michael S. Tsirkin mst@redhat.com Link: https://lore.kernel.org/r/20220425014502.985464-1-liuhangbin@gmail.com Signed-off-by: Paolo Abeni pabeni@redhat.com Tested-by: Tudor Ambarus tudor.ambarus@linaro.org [ta: Update commit description, add Cc, Fixes, Reported-by and Tested-by.] Signed-off-by: Tudor Ambarus tudor.ambarus@linaro.org --- net/packet/af_packet.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-)
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c index ceca0d6c41b5..f25fa75fe651 100644 --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -1888,12 +1888,20 @@ static int packet_rcv_spkt(struct sk_buff *skb, struct net_device *dev,
static void packet_parse_headers(struct sk_buff *skb, struct socket *sock) { + int depth; + if ((!skb->protocol || skb->protocol == htons(ETH_P_ALL)) && sock->type == SOCK_RAW) { skb_reset_mac_header(skb); skb->protocol = dev_parse_header_protocol(skb); }
+ /* Move network header to the right position for VLAN tagged packets */ + if (likely(skb->dev->type == ARPHRD_ETHER) && + eth_type_vlan(skb->protocol) && + __vlan_get_protocol(skb, skb->protocol, &depth) != 0) + skb_set_network_header(skb, depth); + skb_probe_transport_header(skb); }
@@ -3008,6 +3016,11 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) skb->mark = sockc.mark; skb->tstamp = sockc.transmit_time;
+ if (unlikely(extra_len == 4)) + skb->no_fcs = 1; + + packet_parse_headers(skb, sock); + if (has_vnet_hdr) { err = virtio_net_hdr_to_skb(skb, &vnet_hdr, vio_le()); if (err) @@ -3016,11 +3029,6 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) virtio_net_hdr_set_proto(skb, &vnet_hdr); }
- packet_parse_headers(skb, sock); - - if (unlikely(extra_len == 4)) - skb->no_fcs = 1; - err = po->xmit(skb); if (unlikely(err != 0)) { if (err > 0)