[PATCH net v3 1/2] ip6_tunnel: Clear IP6CB in ip6tunnel_xmit()

[PATCH net v3 1/2] ip6_tunnel: Clear IP6CB in ip6tunnel_xmit()

[Eli Cooper]

skb->cb may contain data from previous layers. In the observed scenario,
the garbage data were misinterpreted as IP6CB(skb)->frag_max_size, so
that small packets sent through the tunnel are mistakenly fragmented.

This patch unconditionally clears the control buffer in ip6tunnel_xmit(),
which affects ip6_tunnel, ip6_udp_tunnel and ip6_gre. Currently none of
these tunnels set IP6CB(skb)->flags, otherwise it needs to be done earlier.

Cc: stable@vger.kernel.org
Signed-off-by: Eli Cooper <elicooper@gmx.com>
---
v3: moves to ip6tunnel_xmit() and clears IP6CB unconditionally
v2: clears the whole IP6CB altogether and does it after encapsulation

 include/net/ip6_tunnel.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/include/net/ip6_tunnel.h b/include/net/ip6_tunnel.h
index 20ed969..1b1cf33 100644
--- a/include/net/ip6_tunnel.h
+++ b/include/net/ip6_tunnel.h
@@ -146,6 +146,7 @@ static inline void ip6tunnel_xmit(struct sock *sk, struct sk_buff *skb,
 {
 	int pkt_len, err;
 
+	memset(skb->cb, 0, sizeof(struct inet6_skb_parm));
 	pkt_len = skb->len - skb_inner_network_offset(skb);
 	err = ip6_local_out(dev_net(skb_dst(skb)->dev), sk, skb);
 	if (unlikely(net_xmit_eval(err)))
-- 
2.10.1

[PATCH net v3 2/2] ip6_udp_tunnel: remove unused IPCB related codes

[Eli Cooper]

Some IPCB fields are currently set in udp_tunnel6_xmit_skb(), which are
never used before it reaches ip6tunnel_xmit(), and past that point the
control buffer is no longer interpreted as IPCB.

This clears these unused IPCB related codes. Currently there is no skb
scrubbing in ip6_udp_tunnel, otherwise IPCB(skb)->opt might need to be
cleared for IPv4 packets, as shown in 5146d1f1511
("tunnel: Clear IPCB(skb)->opt before dst_link_failure called").

Signed-off-by: Eli Cooper <elicooper@gmx.com>
---
 net/ipv6/ip6_udp_tunnel.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/net/ipv6/ip6_udp_tunnel.c b/net/ipv6/ip6_udp_tunnel.c
index a752052..b283f29 100644
--- a/net/ipv6/ip6_udp_tunnel.c
+++ b/net/ipv6/ip6_udp_tunnel.c
@@ -88,9 +88,6 @@ int udp_tunnel6_xmit_skb(struct dst_entry *dst, struct sock *sk,
 
 	uh->len = htons(skb->len);
 
-	memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
-	IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED
-			    | IPSKB_REROUTED);
 	skb_dst_set(skb, dst);
 
 	udp6_set_csum(nocheck, skb, saddr, daddr, skb->len);
-- 
2.10.1

Re: [PATCH net v3 2/2] ip6_udp_tunnel: remove unused IPCB related codes

[David Miller]

From: Eli Cooper <elicooper@gmx.com>
Date: Tue,  1 Nov 2016 23:45:13 +0800

> Some IPCB fields are currently set in udp_tunnel6_xmit_skb(), which are
> never used before it reaches ip6tunnel_xmit(), and past that point the
> control buffer is no longer interpreted as IPCB.
> 
> This clears these unused IPCB related codes. Currently there is no skb
> scrubbing in ip6_udp_tunnel, otherwise IPCB(skb)->opt might need to be
> cleared for IPv4 packets, as shown in 5146d1f1511
> ("tunnel: Clear IPCB(skb)->opt before dst_link_failure called").
> 
> Signed-off-by: Eli Cooper <elicooper@gmx.com>

Applied.

Re: [PATCH net v3 1/2] ip6_tunnel: Clear IP6CB in ip6tunnel_xmit()

[David Miller]

From: Eli Cooper <elicooper@gmx.com>
Date: Tue,  1 Nov 2016 23:45:12 +0800

> skb->cb may contain data from previous layers. In the observed scenario,
> the garbage data were misinterpreted as IP6CB(skb)->frag_max_size, so
> that small packets sent through the tunnel are mistakenly fragmented.
> 
> This patch unconditionally clears the control buffer in ip6tunnel_xmit(),
> which affects ip6_tunnel, ip6_udp_tunnel and ip6_gre. Currently none of
> these tunnels set IP6CB(skb)->flags, otherwise it needs to be done earlier.
> 
> Cc: stable@vger.kernel.org
> Signed-off-by: Eli Cooper <elicooper@gmx.com>
> ---
> v3: moves to ip6tunnel_xmit() and clears IP6CB unconditionally
> v2: clears the whole IP6CB altogether and does it after encapsulation

Applied and queued up for -stable.