From mboxrd@z Thu Jan 1 00:00:00 1970 From: Pravin B Shelar Subject: [PATCH net] skbuff: Fix skb checksum flag on skb pull Date: Mon, 31 Aug 2015 15:55:46 -0700 Message-ID: <1441061746-1492-1-git-send-email-pshelar@nicira.com> Cc: Pravin B Shelar To: netdev@vger.kernel.org Return-path: Received: from mail-pa0-f49.google.com ([209.85.220.49]:35994 "EHLO mail-pa0-f49.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752734AbbHaWzu (ORCPT ); Mon, 31 Aug 2015 18:55:50 -0400 Received: by pacgr6 with SMTP id gr6so2567991pac.3 for ; Mon, 31 Aug 2015 15:55:50 -0700 (PDT) Sender: netdev-owner@vger.kernel.org List-ID: VXLAN device can receive skb with checksum partial. But the checksum offset could be in outer header which is pulled on receive. Such skb can cause the panic when checksum is calculated on skb. Following patch fixes the bug by setting checksum unnecessary while pulling outer header. ---8<--- [ 13.800141] RIP: 0010:[] [] skb_checksum_help+0x144/0x150 [ 13.800141] RSP: 0000:ffff88011fd83940 EFLAGS: 00010292 [ 13.800141] RAX: 0000000000000042 RBX: ffff880114dd56c0 RCX: ffff8801188d9580 ... ... [ 13.852308] Call Trace: [ 13.852308] [ 13.852308] [] queue_userspace_packet+0x408/0x470 [openvswitch] [ 13.852308] [] ovs_dp_upcall+0x5d/0x60 [openvswitch] [ 13.852308] [] ovs_dp_process_packet_with_key+0xe6/0x100 [openvswitch] [ 13.852308] [] ovs_dp_process_received_packet+0x4b/0x80 [openvswitch] [ 13.852308] [] ovs_vport_receive+0x2a/0x30 [openvswitch] [ 13.852308] [] vxlan_rcv+0x53/0x60 [openvswitch] [ 13.852308] [] vxlan_udp_encap_recv+0x8b/0xf0 [openvswitch] [ 13.852308] [] udp_queue_rcv_skb+0x2dc/0x3b0 [ 13.852308] [] __udp4_lib_rcv+0x1cf/0x6c0 [ 13.852308] [] udp_rcv+0x1a/0x20 [ 13.852308] [] ip_local_deliver_finish+0xdd/0x280 [ 13.852308] [] ip_local_deliver+0x88/0x90 [ 13.852308] [] ip_rcv_finish+0x10d/0x370 [ 13.852308] [] ip_rcv+0x235/0x300 [ 13.852308] [] __netif_receive_skb+0x55d/0x620 [ 13.852308] [] netif_receive_skb+0x80/0x90 [ 13.852308] [] virtnet_poll+0x555/0x6f0 [ 13.852308] [] net_rx_action+0x134/0x290 [ 13.852308] [] __do_softirq+0xa8/0x210 [ 13.852308] [] call_softirq+0x1c/0x30 [ 13.852308] [] do_softirq+0x65/0xa0 [ 13.852308] [] irq_exit+0x8e/0xb0 [ 13.852308] [] do_IRQ+0x63/0xe0 [ 13.852308] [] common_interrupt+0x6e/0x6e [ 13.852308] [ 13.852308] [] ? system_call_fastpath+0x16/0x1b Reported-by: Anupam Chanda Signed-off-by: Pravin B Shelar --- include/linux/skbuff.h | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index 9b88536..6238e9f 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -2601,6 +2601,9 @@ static inline void skb_postpull_rcsum(struct sk_buff *skb, { if (skb->ip_summed == CHECKSUM_COMPLETE) skb->csum = csum_sub(skb->csum, csum_partial(start, len, 0)); + else if (skb->ip_summed == CHECKSUM_PARTIAL && + skb_checksum_start_offset(skb) <= len) + skb->ip_summed = CHECKSUM_UNNECESSARY; } unsigned char *skb_pull_rcsum(struct sk_buff *skb, unsigned int len); -- 1.7.1