lkml.org 
[lkml]   [2015]   [May]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.2 197/221] macvtap: make sure neighbour code can push ethernet header
    3.2.69-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Eric Dumazet <edumazet@google.com>

    [ Upstream commit 2f1d8b9e8afa5a833d96afcd23abcb8cdf8d83ab ]

    Brian reported crashes using IPv6 traffic with macvtap/veth combo.

    I tracked the crashes in neigh_hh_output()

    -> memcpy(skb->data - HH_DATA_MOD, hh->hh_data, HH_DATA_MOD);

    Neighbour code assumes headroom to push Ethernet header is
    at least 16 bytes.

    It appears macvtap has only 14 bytes available on arches
    where NET_IP_ALIGN is 0 (like x86)

    Effect is a corruption of 2 bytes right before skb->head,
    and possible crashes if accessing non existing memory.

    This fix should also increase IPv4 performance, as paranoid code
    in ip_finish_output2() wont have to call skb_realloc_headroom()

    Reported-by: Brian Rak <brak@vultr.com>
    Tested-by: Brian Rak <brak@vultr.com>
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    drivers/net/macvtap.c | 7 +++++--
    1 file changed, 5 insertions(+), 2 deletions(-)

    --- a/drivers/net/macvtap.c
    +++ b/drivers/net/macvtap.c
    @@ -667,12 +667,15 @@ static unsigned long iov_pages(const str
    return pages;
    }

    +/* Neighbour code has some assumptions on HH_DATA_MOD alignment */
    +#define MACVTAP_RESERVE HH_DATA_OFF(ETH_HLEN)
    +
    /* Get packet from user space buffer */
    static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
    const struct iovec *iv, unsigned long total_len,
    size_t count, int noblock)
    {
    - int good_linear = SKB_MAX_HEAD(NET_IP_ALIGN);
    + int good_linear = SKB_MAX_HEAD(MACVTAP_RESERVE);
    struct sk_buff *skb;
    struct macvlan_dev *vlan;
    unsigned long len = total_len;
    @@ -731,7 +734,7 @@ static ssize_t macvtap_get_user(struct m
    linear = vnet_hdr.hdr_len;
    }

    - skb = macvtap_alloc_skb(&q->sk, NET_IP_ALIGN, copylen,
    + skb = macvtap_alloc_skb(&q->sk, MACVTAP_RESERVE, copylen,
    linear, noblock, &err);
    if (!skb)
    goto err;


    \
     
     \ /
      Last update: 2015-05-05 04:01    [W:2.343 / U:0.124 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site