[PATCH net] net: mhi: set skb mac header before entering RX path

[PATCH net] net: mhi: set skb mac header before entering RX path

[Martin Fäcknitz]

skb->mac_header must be set before passing the skb to the network stack,
because skb->mac_len is calculated from skb->mac_header in
__netif_receive_skb_core.

Some network stack components, like xfrm, are using skb->mac_len to
check for an existing MAC header, which doesn't exist in this case. This
leads to memory corruption.

Signed-off-by: Martin Fäcknitz <faecknitz@hotsplots.de>
---
 drivers/net/mhi_net.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/mhi_net.c b/drivers/net/mhi_net.c
index ae169929a9d8..e432efddcb22 100644
--- a/drivers/net/mhi_net.c
+++ b/drivers/net/mhi_net.c
@@ -221,6 +221,8 @@ static void mhi_net_dl_callback(struct mhi_device *mhi_dev,
 			break;
 		}
 
+		skb_reset_mac_header(skb);
+
 		u64_stats_update_begin(&mhi_netdev->stats.rx_syncp);
 		u64_stats_inc(&mhi_netdev->stats.rx_packets);
 		u64_stats_add(&mhi_netdev->stats.rx_bytes, skb->len);
-- 
2.11.0

Re: [PATCH net] net: mhi: set skb mac header before entering RX path

[Jakub Kicinski]

On Mon, 13 May 2024 15:38:30 +0200 Martin Fäcknitz wrote:
> skb->mac_header must be set before passing the skb to the network stack,
> because skb->mac_len is calculated from skb->mac_header in
> __netif_receive_skb_core.
> 
> Some network stack components, like xfrm, are using skb->mac_len to
> check for an existing MAC header, which doesn't exist in this case. This
> leads to memory corruption.

Could you add a Fixes tag identifying the commit where the buggy code
was added? And please make sure to CC the relevant maintainers (I mean
the maintainers of the MHI code, specifically) on v2.
-- 
pw-bot: cr