From: Abdelrhman Ahmed <ab@abahmed.com>
To: netdev@vger.kernel.org
Subject: [PATCH] net: Fix skb_network_offset in neigh_resolve_output and neigh_connected_output
Date: Thu, 16 Jun 2016 08:50:21 +0200 [thread overview]
Message-ID: <57624C2D.8020906@abahmed.com> (raw)
Commit e1f165032c8bade3a6bdf546f8faf61fda4dd01c ("net: Fix
skb_under_panic oops in neigh_resolve_output") resets the skb to
network_header, but this will discard header or data which is inserted
by netfilter hooks (e.g. POSTROUTING) between network layer and hardware
header only for the first packet(s) before using cached hardware header
and this will lead to inconsistent behavior for outgoing packets.
The fix is to reset with reference to skb's data pointer before loop
instead of network header.
Signed-off-by: Abdelrhman Ahmed <ab@abahmed.com>
--- net/core/neighbour.c.orig 2016-06-16 05:52:26.521301488 +0200
+++ net/core/neighbour.c 2016-06-16 08:09:54.577222828 +0200
@@ -1293,15 +1293,19 @@ int neigh_resolve_output(struct neighbou
int rc = 0;
if (!neigh_event_send(neigh, skb)) {
- int err;
+ int err, offset;
struct net_device *dev = neigh->dev;
+ unsigned char *data;
unsigned int seq;
if (dev->header_ops->cache && !neigh->hh.hh_len)
neigh_hh_init(neigh);
+ data = skb->data;
+
do {
- __skb_pull(skb, skb_network_offset(skb));
+ offset = data - skb->data;
+ __skb_pull(skb, offset);
seq = read_seqbegin(&neigh->ha_lock);
err = dev_hard_header(skb, dev, ntohs(skb->protocol),
neigh->ha, NULL, skb->len);
@@ -1326,11 +1330,15 @@ EXPORT_SYMBOL(neigh_resolve_output);
int neigh_connected_output(struct neighbour *neigh, struct sk_buff *skb)
{
struct net_device *dev = neigh->dev;
+ unsigned char *data;
unsigned int seq;
- int err;
+ int err, offset;
+
+ data = skb->data;
do {
- __skb_pull(skb, skb_network_offset(skb));
+ offset = data - skb->data;
+ __skb_pull(skb, offset);
seq = read_seqbegin(&neigh->ha_lock);
err = dev_hard_header(skb, dev, ntohs(skb->protocol),
neigh->ha, NULL, skb->len);
--
Regards,
Abdelrhman
reply other threads:[~2016-06-16 6:50 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=57624C2D.8020906@abahmed.com \
--to=ab@abahmed.com \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).