net/sched: act_vlan: Push skb->data to mac_header prior calling skb_vlan_*() functions

[ Upstream commit f39acc84aad10710e89835c60d3b6694c43a8dd9 ]

Generic skb_vlan_push/skb_vlan_pop functions don't properly handle the
case where the input skb data pointer does not point at the mac header:

- They're doing push/pop, but fail to properly unwind data back to its
  original location.
  For example, in the skb_vlan_push case, any subsequent
  'skb_push(skb, skb->mac_len)' calls make the skb->data point 4 bytes
  BEFORE start of frame, leading to bogus frames that may be transmitted.

- They update rcsum per the added/removed 4 bytes tag.
  Alas if data is originally after the vlan/eth headers, then these
  bytes were already pulled out of the csum.

OTOH calling skb_vlan_push/skb_vlan_pop with skb->data at mac_header
present no issues.

act_vlan is the only caller to skb_vlan_*() that has skb->data pointing
at network header (upon ingress).
Other calles (ovs, bpf) already adjust skb->data at mac_header.

This patch fixes act_vlan to point to the mac_header prior calling
skb_vlan_*() functions, as other callers do.

Signed-off-by: Shmulik Ladkani <shmulik.ladkani@gmail.com>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Pravin Shelar <pshelar@ovn.org>
Cc: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index 86df0835f6b58517c671e200779d9045200cb5d3..e5bba897d20649223bf393b94a66677177e0f554 100644 (file)
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -408,6 +408,15 @@ bool tcf_destroy(struct tcf_proto *tp, bool force);
 void tcf_destroy_chain(struct tcf_proto __rcu **fl);
 int skb_do_redirect(struct sk_buff *);
 
+static inline bool skb_at_tc_ingress(const struct sk_buff *skb)
+{
+#ifdef CONFIG_NET_CLS_ACT
+       return G_TC_AT(skb->tc_verd) & AT_INGRESS;
+#else
+       return false;
+#endif
+}
+
 /* Reset all TX qdiscs greater then index of a device.  */
 static inline void qdisc_reset_all_tx_gt(struct net_device *dev, unsigned int i)
 {

diff --git a/net/sched/act_vlan.c b/net/sched/act_vlan.c
index 796785e0bf96b0e65f598d3b2dad8256485d034a..d7edba4536bd22258cdcb302ce1c863a6082c890 100644 (file)
--- a/net/sched/act_vlan.c
+++ b/net/sched/act_vlan.c
@@ -33,6 +33,12 @@ static int tcf_vlan(struct sk_buff *skb, const struct tc_action *a,
        bstats_update(&v->tcf_bstats, skb);
        action = v->tcf_action;
 
+       /* Ensure 'data' points at mac_header prior calling vlan manipulating
+        * functions.
+        */
+       if (skb_at_tc_ingress(skb))
+               skb_push_rcsum(skb, skb->mac_len);
+
        switch (v->tcfv_action) {
        case TCA_VLAN_ACT_POP:
                err = skb_vlan_pop(skb);
@@ -54,6 +60,9 @@ drop:
        action = TC_ACT_SHOT;
        v->tcf_qstats.drops++;
 unlock:
+       if (skb_at_tc_ingress(skb))
+               skb_pull_rcsum(skb, skb->mac_len);
+
        spin_unlock(&v->tcf_lock);
        return action;
 }