From mboxrd@z Thu Jan 1 00:00:00 1970 From: Daniel Axtens Subject: [PATCH] macvlan: verify MTU before lowerdev xmit Date: Tue, 14 Nov 2017 21:32:51 +1100 Message-ID: <20171114103251.5495-1-dja@axtens.net> Cc: Daniel Axtens , Shannon Nelson To: netdev@vger.kernel.org Return-path: Received: from mail-pg0-f66.google.com ([74.125.83.66]:47032 "EHLO mail-pg0-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754843AbdKNKdS (ORCPT ); Tue, 14 Nov 2017 05:33:18 -0500 Received: by mail-pg0-f66.google.com with SMTP id t10so14004539pgo.3 for ; Tue, 14 Nov 2017 02:33:18 -0800 (PST) Sender: netdev-owner@vger.kernel.org List-ID: If a macvlan device which is not in bridge mode receives a packet, it is sent straight to the lowerdev without checking against the device's MTU. This also happens for multicast traffic. Add an is_skb_forwardable() check against the lowerdev before sending the packet out through it. I think this is the simplest and best way to do it, and is consistent with the use of dev_forward_skb() in the bridge path. This is easy to replicate: - create a VM with a macvtap connection in private mode - set the lowerdev MTU to something low in the host (e.g. 1480) - do not set the MTU lower in the guest (e.g. keep at 1500) - netperf to a different host with the same high MTU - observe that currently, the driver will forward too-big packets - observe that with this patch the packets are dropped Cc: Shannon Nelson Signed-off-by: Daniel Axtens --- After hearing Shannon's lightning talk on macvlan at netdev I figured I'd strike while the iron is hot and get this out of my patch queue where it has been languishing. --- drivers/net/macvlan.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c index a178c5efd33e..8adcad6798c5 100644 --- a/drivers/net/macvlan.c +++ b/drivers/net/macvlan.c @@ -534,6 +534,10 @@ static int macvlan_queue_xmit(struct sk_buff *skb, struct net_device *dev) } xmit_world: + /* verify MTU */ + if (!is_skb_forwardable(vlan->lowerdev, skb)) + return NET_XMIT_DROP; + skb->dev = vlan->lowerdev; return dev_queue_xmit(skb); } -- 2.11.0