* [PATCH net 1/1] net: sched: act_csum: validate nested VLAN headers [not found] <cover.1774892775.git.caoruide123@gmail.com> @ 2026-04-02 14:46 ` Ren Wei 2026-04-03 16:26 ` Simon Horman 2026-04-03 22:00 ` patchwork-bot+netdevbpf 0 siblings, 2 replies; 3+ messages in thread From: Ren Wei @ 2026-04-02 14:46 UTC (permalink / raw) To: netdev Cc: jhs, jiri, davem, edumazet, kuba, pabeni, horms, elibr, yifanwucs, tomapufckgml, yuantan098, bird, enjou1224z, caoruide123, n05ec From: Ruide Cao <caoruide123@gmail.com> tcf_csum_act() walks nested VLAN headers directly from skb->data when an skb still carries in-payload VLAN tags. The current code reads vlan->h_vlan_encapsulated_proto and then pulls VLAN_HLEN bytes without first ensuring that the full VLAN header is present in the linear area. If only part of an inner VLAN header is linearized, accessing h_vlan_encapsulated_proto reads past the linear area, and the following skb_pull(VLAN_HLEN) may violate skb invariants. Fix this by requiring pskb_may_pull(skb, VLAN_HLEN) before accessing and pulling each nested VLAN header. If the header still is not fully available, drop the packet through the existing error path. Fixes: 2ecba2d1e45b ("net: sched: act_csum: Fix csum calc for tagged packets") Reported-by: Yifan Wu <yifanwucs@gmail.com> Reported-by: Juefei Pu <tomapufckgml@gmail.com> Co-developed-by: Yuan Tan <yuantan098@gmail.com> Signed-off-by: Yuan Tan <yuantan098@gmail.com> Suggested-by: Xin Liu <bird@lzu.edu.cn> Tested-by: Ren Wei <enjou1224z@gmail.com> Signed-off-by: Ruide Cao <caoruide123@gmail.com> Signed-off-by: Ren Wei <n05ec@lzu.edu.cn> --- net/sched/act_csum.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/net/sched/act_csum.c b/net/sched/act_csum.c index 213e1ce9d2da..a9e4635d899e 100644 --- a/net/sched/act_csum.c +++ b/net/sched/act_csum.c @@ -604,8 +604,12 @@ TC_INDIRECT_SCOPE int tcf_csum_act(struct sk_buff *skb, protocol = skb->protocol; orig_vlan_tag_present = true; } else { - struct vlan_hdr *vlan = (struct vlan_hdr *)skb->data; + struct vlan_hdr *vlan; + if (!pskb_may_pull(skb, VLAN_HLEN)) + goto drop; + + vlan = (struct vlan_hdr *)skb->data; protocol = vlan->h_vlan_encapsulated_proto; skb_pull(skb, VLAN_HLEN); skb_reset_network_header(skb); -- 2.34.1 ^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH net 1/1] net: sched: act_csum: validate nested VLAN headers 2026-04-02 14:46 ` [PATCH net 1/1] net: sched: act_csum: validate nested VLAN headers Ren Wei @ 2026-04-03 16:26 ` Simon Horman 2026-04-03 22:00 ` patchwork-bot+netdevbpf 1 sibling, 0 replies; 3+ messages in thread From: Simon Horman @ 2026-04-03 16:26 UTC (permalink / raw) To: Ren Wei Cc: netdev, jhs, jiri, davem, edumazet, kuba, pabeni, elibr, yifanwucs, tomapufckgml, yuantan098, bird, enjou1224z, caoruide123 On Thu, Apr 02, 2026 at 10:46:20PM +0800, Ren Wei wrote: > From: Ruide Cao <caoruide123@gmail.com> > > tcf_csum_act() walks nested VLAN headers directly from skb->data when an > skb still carries in-payload VLAN tags. The current code reads > vlan->h_vlan_encapsulated_proto and then pulls VLAN_HLEN bytes without > first ensuring that the full VLAN header is present in the linear area. > > If only part of an inner VLAN header is linearized, accessing > h_vlan_encapsulated_proto reads past the linear area, and the following > skb_pull(VLAN_HLEN) may violate skb invariants. > > Fix this by requiring pskb_may_pull(skb, VLAN_HLEN) before accessing and > pulling each nested VLAN header. If the header still is not fully > available, drop the packet through the existing error path. > > Fixes: 2ecba2d1e45b ("net: sched: act_csum: Fix csum calc for tagged packets") > Reported-by: Yifan Wu <yifanwucs@gmail.com> > Reported-by: Juefei Pu <tomapufckgml@gmail.com> > Co-developed-by: Yuan Tan <yuantan098@gmail.com> > Signed-off-by: Yuan Tan <yuantan098@gmail.com> > Suggested-by: Xin Liu <bird@lzu.edu.cn> > Tested-by: Ren Wei <enjou1224z@gmail.com> > Signed-off-by: Ruide Cao <caoruide123@gmail.com> > Signed-off-by: Ren Wei <n05ec@lzu.edu.cn> Reviewed-by: Simon Horman <horms@kernel.org> ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH net 1/1] net: sched: act_csum: validate nested VLAN headers 2026-04-02 14:46 ` [PATCH net 1/1] net: sched: act_csum: validate nested VLAN headers Ren Wei 2026-04-03 16:26 ` Simon Horman @ 2026-04-03 22:00 ` patchwork-bot+netdevbpf 1 sibling, 0 replies; 3+ messages in thread From: patchwork-bot+netdevbpf @ 2026-04-03 22:00 UTC (permalink / raw) To: Ren Wei Cc: netdev, jhs, jiri, davem, edumazet, kuba, pabeni, horms, elibr, yifanwucs, tomapufckgml, yuantan098, bird, enjou1224z, caoruide123 Hello: This patch was applied to netdev/net.git (main) by Jakub Kicinski <kuba@kernel.org>: On Thu, 2 Apr 2026 22:46:20 +0800 you wrote: > From: Ruide Cao <caoruide123@gmail.com> > > tcf_csum_act() walks nested VLAN headers directly from skb->data when an > skb still carries in-payload VLAN tags. The current code reads > vlan->h_vlan_encapsulated_proto and then pulls VLAN_HLEN bytes without > first ensuring that the full VLAN header is present in the linear area. > > [...] Here is the summary with links: - [net,1/1] net: sched: act_csum: validate nested VLAN headers https://git.kernel.org/netdev/net/c/c842743d073b You are awesome, thank you! -- Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html ^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-04-03 22:00 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <cover.1774892775.git.caoruide123@gmail.com>
2026-04-02 14:46 ` [PATCH net 1/1] net: sched: act_csum: validate nested VLAN headers Ren Wei
2026-04-03 16:26 ` Simon Horman
2026-04-03 22:00 ` patchwork-bot+netdevbpf
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox