| From foo@baz Sun 15 Mar 2020 12:39:05 PM CET |
| From: Mahesh Bandewar <maheshb@google.com> |
| Date: Mon, 9 Mar 2020 15:56:56 -0700 |
| Subject: ipvlan: don't deref eth hdr before checking it's set |
| |
| From: Mahesh Bandewar <maheshb@google.com> |
| |
| [ Upstream commit ad8192767c9f9cf97da57b9ffcea70fb100febef ] |
| |
| IPvlan in L3 mode discards outbound multicast packets but performs |
| the check before ensuring the ether-header is set or not. This is |
| an error that Eric found through code browsing. |
| |
| Fixes: 2ad7bf363841 (“ipvlan: Initial check-in of the IPVLAN driver.”) |
| Signed-off-by: Mahesh Bandewar <maheshb@google.com> |
| Reported-by: Eric Dumazet <edumazet@google.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/net/ipvlan/ipvlan_core.c | 18 ++++++++++-------- |
| 1 file changed, 10 insertions(+), 8 deletions(-) |
| |
| --- a/drivers/net/ipvlan/ipvlan_core.c |
| +++ b/drivers/net/ipvlan/ipvlan_core.c |
| @@ -449,19 +449,21 @@ static int ipvlan_process_outbound(struc |
| struct ethhdr *ethh = eth_hdr(skb); |
| int ret = NET_XMIT_DROP; |
| |
| - /* In this mode we dont care about multicast and broadcast traffic */ |
| - if (is_multicast_ether_addr(ethh->h_dest)) { |
| - pr_debug_ratelimited("Dropped {multi|broad}cast of type=[%x]\n", |
| - ntohs(skb->protocol)); |
| - kfree_skb(skb); |
| - goto out; |
| - } |
| - |
| /* The ipvlan is a pseudo-L2 device, so the packets that we receive |
| * will have L2; which need to discarded and processed further |
| * in the net-ns of the main-device. |
| */ |
| if (skb_mac_header_was_set(skb)) { |
| + /* In this mode we dont care about |
| + * multicast and broadcast traffic */ |
| + if (is_multicast_ether_addr(ethh->h_dest)) { |
| + pr_debug_ratelimited( |
| + "Dropped {multi|broad}cast of type=[%x]\n", |
| + ntohs(skb->protocol)); |
| + kfree_skb(skb); |
| + goto out; |
| + } |
| + |
| skb_pull(skb, sizeof(*ethh)); |
| skb->mac_header = (typeof(skb->mac_header))~0U; |
| skb_reset_network_header(skb); |
