[PATCH v2] net: mhi: set skb mac header before entering RX path

[PATCH v2] net: mhi: set skb mac header before entering RX path

[Martin Fäcknitz]

skb->mac_header must be set before passing the skb to the network stack,
because skb->mac_len is calculated from skb->mac_header in
__netif_receive_skb_core.

Some network stack components, like xfrm, are using skb->mac_len to
check for an existing MAC header, which doesn't exist in this case. This
leads to memory corruption.

Fixes: 7ffa7542eca6 ("net: mhi: Remove MBIM protocol")
Signed-off-by: Martin Fäcknitz <faecknitz@hotsplots.de>
---
v2: - add "Fixes" tag
    - CC maintainers

 drivers/net/mhi_net.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/mhi_net.c b/drivers/net/mhi_net.c
index ae169929a9d8..e432efddcb22 100644
--- a/drivers/net/mhi_net.c
+++ b/drivers/net/mhi_net.c
@@ -221,6 +221,8 @@ static void mhi_net_dl_callback(struct mhi_device *mhi_dev,
 			break;
 		}
 
+		skb_reset_mac_header(skb);
+
 		u64_stats_update_begin(&mhi_netdev->stats.rx_syncp);
 		u64_stats_inc(&mhi_netdev->stats.rx_packets);
 		u64_stats_add(&mhi_netdev->stats.rx_bytes, skb->len);
-- 
2.11.0

Re: [PATCH v2] net: mhi: set skb mac header before entering RX path

[Paolo Abeni]

On Fri, 2024-05-17 at 23:19 +0200, Martin Fäcknitz wrote:
> skb->mac_header must be set before passing the skb to the network stack,
> because skb->mac_len is calculated from skb->mac_header in
> __netif_receive_skb_core.
> 
> Some network stack components, like xfrm, are using skb->mac_len to
> check for an existing MAC header, which doesn't exist in this case. This
> leads to memory corruption.
> 
> Fixes: 7ffa7542eca6 ("net: mhi: Remove MBIM protocol")

I'm possibly missing something, but the above tag looks incorrect:
AFAICS the mac header was not set even before such commit for the non
WWAN case.

Thanks,

Paolo

Re: [PATCH v2] net: mhi: set skb mac header before entering RX path

[Manivannan Sadhasivam]

+ Loic

On Fri, May 17, 2024 at 11:19:09PM +0200, Martin Fäcknitz wrote:
> skb->mac_header must be set before passing the skb to the network stack,
> because skb->mac_len is calculated from skb->mac_header in
> __netif_receive_skb_core.
> 
> Some network stack components, like xfrm, are using skb->mac_len to
> check for an existing MAC header, which doesn't exist in this case. This
> leads to memory corruption.
> 
> Fixes: 7ffa7542eca6 ("net: mhi: Remove MBIM protocol")

Change looks good to me, but I fail to find the relationship with Fixes tag.

- Mani

> Signed-off-by: Martin Fäcknitz <faecknitz@hotsplots.de>
> ---
> v2: - add "Fixes" tag
>     - CC maintainers
> 
>  drivers/net/mhi_net.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/net/mhi_net.c b/drivers/net/mhi_net.c
> index ae169929a9d8..e432efddcb22 100644
> --- a/drivers/net/mhi_net.c
> +++ b/drivers/net/mhi_net.c
> @@ -221,6 +221,8 @@ static void mhi_net_dl_callback(struct mhi_device *mhi_dev,
>  			break;
>  		}
>  
> +		skb_reset_mac_header(skb);
> +
>  		u64_stats_update_begin(&mhi_netdev->stats.rx_syncp);
>  		u64_stats_inc(&mhi_netdev->stats.rx_packets);
>  		u64_stats_add(&mhi_netdev->stats.rx_bytes, skb->len);
> -- 
> 2.11.0
> 
> 

-- 
மணிவண்ணன் சதாசிவம்