Commit abd5078b authored by Duanqiang Wen's avatar Duanqiang Wen
Browse files

net: wangxun: fix resolving ipv6 pakets extension header errors 

wangxun inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/IBCASR


CVE: NA

----------------------

fix bug of all Outer ipv6 packets with extension header,
and fix bug of IP over IP with ipvX/ipv6 mode.

Fixes: a5961b4b ("openeuler: net: ngbe: add ngbe module support")
Fixes: a493f74a ("net: txgbe: Add support for Netswift 10G NIC")
Signed-off-by: default avatarDuanqiang Wen <duanqiangwen@net-swift.com>
parent a6539819

drivers/net/ethernet/netswift/ngbe/ngbe_main.c

+51 −36
Original line number Diff line number Diff line
@@ -5141,36 +5141,6 @@ static void ngbe_service_task(struct work_struct *work) 
	ngbe_service_event_complete(adapter);

}



static u8 get_ipv6_proto(struct sk_buff *skb, int offset)

{

	struct ipv6hdr *hdr = (struct ipv6hdr *)(skb->data + offset);

	u8 nexthdr = hdr->nexthdr;



	offset += sizeof(struct ipv6hdr);



	while (ipv6_ext_hdr(nexthdr)) {

		struct ipv6_opt_hdr _hdr, *hp;



		if (nexthdr == NEXTHDR_NONE)

			break;



		hp = skb_header_pointer(skb, offset, sizeof(_hdr), &_hdr);

		if (!hp)

			break;



		if (nexthdr == NEXTHDR_FRAGMENT)

			break;

		else if (nexthdr == NEXTHDR_AUTH)

			offset +=  ipv6_authlen(hp);

		else

			offset +=  ipv6_optlen(hp);



		nexthdr = hp->nexthdr;

	}



	return nexthdr;

}



union network_header {

	struct iphdr *ipv4;

	struct ipv6hdr *ipv6;
@@ -5183,6 +5153,9 @@ static struct ngbe_dec_ptype encode_tx_desc_ptype(const struct ngbe_tx_buffer *f 
	u8 tun_prot = 0;

	u8 l4_prot = 0;

	u8 ptype = 0;

	unsigned char *exthdr;

	unsigned char *l4_hdr;

	__be16 frag_off;



	if (skb->encapsulation) {

		union network_header hdr;
@@ -5195,7 +5168,13 @@ static struct ngbe_dec_ptype encode_tx_desc_ptype(const struct ngbe_tx_buffer *f 
			ptype = NGBE_PTYPE_TUN_IPV4;

			break;

		case htons(ETH_P_IPV6):

			tun_prot = get_ipv6_proto(skb, skb_network_offset(skb));

			l4_hdr = skb_transport_header(skb);

			exthdr = skb_network_header(skb) + sizeof(struct ipv6hdr);

			tun_prot = ipv6_hdr(skb)->nexthdr;

			if (l4_hdr != exthdr)

				ipv6_skip_exthdr(skb, exthdr - skb->data,

						 &tun_prot, &frag_off);



			if (tun_prot == NEXTHDR_FRAGMENT)

				goto encap_frag;

			ptype = NGBE_PTYPE_TUN_IPV6;
@@ -5204,7 +5183,8 @@ static struct ngbe_dec_ptype encode_tx_desc_ptype(const struct ngbe_tx_buffer *f 
			goto exit;

		}



		if (tun_prot == IPPROTO_IPIP) {

		if (tun_prot == IPPROTO_IPIP ||

		    tun_prot == IPPROTO_IPV6) {

			hdr.raw = (void *)inner_ip_hdr(skb);

			ptype |= NGBE_PTYPE_PKT_IPIP;

		} else if (tun_prot == IPPROTO_UDP) {
@@ -5222,8 +5202,13 @@ static struct ngbe_dec_ptype encode_tx_desc_ptype(const struct ngbe_tx_buffer *f 
			}

			break;

		case 6:

			l4_prot = get_ipv6_proto(skb,

						 skb_inner_network_offset(skb));

			l4_hdr = skb_inner_transport_header(skb);

			exthdr = skb_inner_network_header(skb) + sizeof(struct ipv6hdr);

			l4_prot = inner_ipv6_hdr(skb)->nexthdr;

			if (l4_hdr != exthdr)

				ipv6_skip_exthdr(skb, exthdr - skb->data,

						 &l4_prot, &frag_off);



			ptype |= NGBE_PTYPE_PKT_IPV6;

			if (l4_prot == NEXTHDR_FRAGMENT) {

				ptype |= NGBE_PTYPE_TYP_IPFRAG;
@@ -5246,7 +5231,13 @@ static struct ngbe_dec_ptype encode_tx_desc_ptype(const struct ngbe_tx_buffer *f 
			break;

#ifdef NETIF_F_IPV6_CSUM

		case htons(ETH_P_IPV6):

			l4_prot = get_ipv6_proto(skb, skb_network_offset(skb));

			l4_hdr = skb_transport_header(skb);

			exthdr = skb_network_header(skb) + sizeof(struct ipv6hdr);

			l4_prot = ipv6_hdr(skb)->nexthdr;

			if (l4_hdr != exthdr)

				ipv6_skip_exthdr(skb, exthdr - skb->data,

						 &l4_prot, &frag_off);



			ptype = NGBE_PTYPE_PKT_IP | NGBE_PTYPE_PKT_IPV6;

			if (l4_prot == NEXTHDR_FRAGMENT) {

				ptype |= NGBE_PTYPE_TYP_IPFRAG;
@@ -5308,6 +5299,9 @@ static int ngbe_tso(struct ngbe_ring *tx_ring, 
	struct iphdr *iph;

	u32 tunhdr_eiplen_tunlen = 0;

	u8 tun_prot = 0;

	unsigned char *exthdr;

	unsigned char *l4_hdr;

	__be16 frag_off;

	bool enc = skb->encapsulation;



	struct ipv6hdr *ipv6h;
@@ -5373,7 +5367,12 @@ static int ngbe_tso(struct ngbe_ring *tx_ring, 
			first->tx_flags |= NGBE_TX_FLAGS_OUTER_IPV4;

			break;

		case htons(ETH_P_IPV6):

			l4_hdr = skb_transport_header(skb);

			exthdr = skb_network_header(skb) + sizeof(struct ipv6hdr);

			tun_prot = ipv6_hdr(skb)->nexthdr;

			if (l4_hdr != exthdr)

				ipv6_skip_exthdr(skb, exthdr - skb->data,

						 &tun_prot, &frag_off);

			break;

		default:

			break;
@@ -5398,6 +5397,7 @@ static int ngbe_tso(struct ngbe_ring *tx_ring, 
					NGBE_TXD_TUNNEL_LEN_SHIFT);

			break;

		case IPPROTO_IPIP:

		case IPPROTO_IPV6:

			tunhdr_eiplen_tunlen = (((char *)inner_ip_hdr(skb) -

						(char *)ip_hdr(skb)) >> 2) <<

						NGBE_TXD_OUTER_IPLEN_SHIFT;
@@ -5440,6 +5440,10 @@ static void ngbe_tx_csum(struct ngbe_ring *tx_ring, 
				  NGBE_TXD_MACLEN_SHIFT;

	} else {

		u8 l4_prot = 0;

		unsigned char *exthdr;

		unsigned char *l4_hdr;

		__be16 frag_off;



		union {

			struct iphdr *ipv4;

			struct ipv6hdr *ipv6;
@@ -5460,7 +5464,13 @@ static void ngbe_tx_csum(struct ngbe_ring *tx_ring, 
				tun_prot = ip_hdr(skb)->protocol;

				break;

			case htons(ETH_P_IPV6):

				l4_hdr = skb_transport_header(skb);

				exthdr = skb_network_header(skb) + sizeof(struct ipv6hdr);

				tun_prot = ipv6_hdr(skb)->nexthdr;

				if (l4_hdr != exthdr)

					ipv6_skip_exthdr(skb, exthdr - skb->data,

							 &tun_prot, &frag_off);



				break;

			default:

				if (unlikely(net_ratelimit())) {
@@ -5490,6 +5500,7 @@ static void ngbe_tx_csum(struct ngbe_ring *tx_ring, 
					NGBE_TXD_TUNNEL_LEN_SHIFT);

				break;

			case IPPROTO_IPIP:

			case IPPROTO_IPV6:

				tunhdr_eiplen_tunlen =

					(((char *)inner_ip_hdr(skb)-

					(char *)ip_hdr(skb)) >> 2) <<
@@ -5515,7 +5526,11 @@ static void ngbe_tx_csum(struct ngbe_ring *tx_ring, 
		case 6:

			vlan_macip_lens |=

				(transport_hdr.raw - network_hdr.raw) >> 1;

			exthdr = network_hdr.raw + sizeof(struct ipv6hdr);

			l4_prot = network_hdr.ipv6->nexthdr;

			if (transport_hdr.raw != exthdr)

				ipv6_skip_exthdr(skb, exthdr - skb->data,

						 &l4_prot, &frag_off);

			break;

		default:

			break;

drivers/net/ethernet/netswift/txgbe/txgbe_main.c

+46 −39
Original line number Diff line number Diff line
@@ -6022,37 +6022,6 @@ static void txgbe_service_task(struct work_struct *work) 
	txgbe_service_event_complete(adapter);

}



static u8 get_ipv6_proto(struct sk_buff *skb, int offset)

{

	struct ipv6hdr *hdr = (struct ipv6hdr *)(skb->data + offset);

	u8 nexthdr = hdr->nexthdr;



	offset += sizeof(struct ipv6hdr);



	while (ipv6_ext_hdr(nexthdr)) {

		struct ipv6_opt_hdr _hdr, *hp;



		if (nexthdr == NEXTHDR_NONE)

			break;



		hp = skb_header_pointer(skb, offset, sizeof(_hdr), &_hdr);

		if (!hp)

			break;



		if (nexthdr == NEXTHDR_FRAGMENT) {

			break;

		} else if (nexthdr == NEXTHDR_AUTH) {

			offset +=  ipv6_authlen(hp);

		} else {

			offset +=  ipv6_optlen(hp);

		}



		nexthdr = hp->nexthdr;

	}



	return nexthdr;

}



union network_header {

	struct iphdr *ipv4;

	struct ipv6hdr *ipv6;
@@ -6062,11 +6031,12 @@ union network_header { 
static txgbe_dptype encode_tx_desc_ptype(const struct txgbe_tx_buffer *first)

{

	struct sk_buff *skb = first->skb;



	u8 tun_prot = 0;



	u8 l4_prot = 0;

	u8 ptype = 0;

	unsigned char *exthdr;

	unsigned char *l4_hdr;

	__be16 frag_off;



	if (skb->encapsulation) {

		union network_header hdr;
@@ -6079,7 +6049,12 @@ static txgbe_dptype encode_tx_desc_ptype(const struct txgbe_tx_buffer *first) 
			ptype = TXGBE_PTYPE_TUN_IPV4;

			break;

		case __constant_htons(ETH_P_IPV6):

			tun_prot = get_ipv6_proto(skb, skb_network_offset(skb));

			l4_hdr = skb_transport_header(skb);

			exthdr = skb_network_header(skb) + sizeof(struct ipv6hdr);

			tun_prot = ipv6_hdr(skb)->nexthdr;

			if (l4_hdr != exthdr)

				ipv6_skip_exthdr(skb, exthdr - skb->data,

						 &tun_prot, &frag_off);

			if (tun_prot == NEXTHDR_FRAGMENT)

				goto encap_frag;

			ptype = TXGBE_PTYPE_TUN_IPV6;
@@ -6088,7 +6063,8 @@ static txgbe_dptype encode_tx_desc_ptype(const struct txgbe_tx_buffer *first) 
			goto exit;

		}



		if (tun_prot == IPPROTO_IPIP) {

		if (tun_prot == IPPROTO_IPIP ||

		    tun_prot == IPPROTO_IPV6) {

			hdr.raw = (void *)inner_ip_hdr(skb);

			ptype |= TXGBE_PTYPE_PKT_IPIP;

		} else if (tun_prot == IPPROTO_UDP) {
@@ -6135,8 +6111,12 @@ static txgbe_dptype encode_tx_desc_ptype(const struct txgbe_tx_buffer *first) 
			}

			break;

		case 6:

			l4_prot = get_ipv6_proto(skb,

						 skb_inner_network_offset(skb));

			l4_hdr = skb_inner_transport_header(skb);

			exthdr = skb_inner_network_header(skb) + sizeof(struct ipv6hdr);

			l4_prot = inner_ipv6_hdr(skb)->nexthdr;

			if (l4_hdr != exthdr)

				ipv6_skip_exthdr(skb, exthdr - skb->data,

						 &l4_prot, &frag_off);

			ptype |= TXGBE_PTYPE_PKT_IPV6;

			if (l4_prot == NEXTHDR_FRAGMENT) {

				ptype |= TXGBE_PTYPE_TYP_IPFRAG;
@@ -6160,7 +6140,13 @@ static txgbe_dptype encode_tx_desc_ptype(const struct txgbe_tx_buffer *first) 
			break;

#ifdef NETIF_F_IPV6_CSUM

		case __constant_htons(ETH_P_IPV6):

			l4_prot = get_ipv6_proto(skb, skb_network_offset(skb));

			l4_hdr = skb_transport_header(skb);

			exthdr = skb_network_header(skb) + sizeof(struct ipv6hdr);

			l4_prot = ipv6_hdr(skb)->nexthdr;

			if (l4_hdr != exthdr)

				ipv6_skip_exthdr(skb, exthdr - skb->data,

						 &l4_prot, &frag_off);



			ptype = TXGBE_PTYPE_PKT_IP | TXGBE_PTYPE_PKT_IPV6;

			if (l4_prot == NEXTHDR_FRAGMENT) {

				ptype |= TXGBE_PTYPE_TYP_IPFRAG;
@@ -6222,8 +6208,10 @@ static int txgbe_tso(struct txgbe_ring *tx_ring, 
	struct tcphdr *tcph;

	struct iphdr *iph;

	u32 tunhdr_eiplen_tunlen = 0;



	u8 tun_prot = 0;

	unsigned char *exthdr;

	unsigned char *l4_hdr;

	__be16 frag_off;

	bool enc = skb->encapsulation;



		struct ipv6hdr *ipv6h;
@@ -6296,7 +6284,12 @@ static int txgbe_tso(struct txgbe_ring *tx_ring, 
			first->tx_flags |= TXGBE_TX_FLAGS_OUTER_IPV4;

			break;

		case __constant_htons(ETH_P_IPV6):

			l4_hdr = skb_transport_header(skb);

			exthdr = skb_network_header(skb) + sizeof(struct ipv6hdr);

			tun_prot = ipv6_hdr(skb)->nexthdr;

			if (l4_hdr != exthdr)

				ipv6_skip_exthdr(skb, exthdr - skb->data,

						 &tun_prot, &frag_off);

			break;

		default:

			break;
@@ -6321,6 +6314,7 @@ static int txgbe_tso(struct txgbe_ring *tx_ring, 
					TXGBE_TXD_TUNNEL_LEN_SHIFT);

			break;

		case IPPROTO_IPIP:

		case IPPROTO_IPV6:

			tunhdr_eiplen_tunlen = (((char *)inner_ip_hdr(skb)-

						(char *)ip_hdr(skb)) >> 2) <<

						TXGBE_TXD_OUTER_IPLEN_SHIFT;
@@ -6362,6 +6356,9 @@ static void txgbe_tx_csum(struct txgbe_ring *tx_ring, 
				  TXGBE_TXD_MACLEN_SHIFT;

	} else {

		u8 l4_prot = 0;

		unsigned char *exthdr;

		unsigned char *l4_hdr;

		__be16 frag_off;



		union {

			struct iphdr *ipv4;
@@ -6383,7 +6380,12 @@ static void txgbe_tx_csum(struct txgbe_ring *tx_ring, 
				tun_prot = ip_hdr(skb)->protocol;

				break;

			case __constant_htons(ETH_P_IPV6):

				l4_hdr = skb_transport_header(skb);

				exthdr = skb_network_header(skb) + sizeof(struct ipv6hdr);

				tun_prot = ipv6_hdr(skb)->nexthdr;

				if (l4_hdr != exthdr)

					ipv6_skip_exthdr(skb, exthdr - skb->data,

							 &tun_prot, &frag_off);

				break;

			default:

				if (unlikely(net_ratelimit())) {
@@ -6413,6 +6415,7 @@ static void txgbe_tx_csum(struct txgbe_ring *tx_ring, 
					TXGBE_TXD_TUNNEL_LEN_SHIFT);

				break;

			case IPPROTO_IPIP:

			case IPPROTO_IPV6:

				tunhdr_eiplen_tunlen =

					(((char *)inner_ip_hdr(skb)-

					(char *)ip_hdr(skb)) >> 2) <<
@@ -6438,7 +6441,11 @@ static void txgbe_tx_csum(struct txgbe_ring *tx_ring, 
		case 6:

			vlan_macip_lens |=

				(transport_hdr.raw - network_hdr.raw) >> 1;

			exthdr = network_hdr.raw + sizeof(struct ipv6hdr);

			l4_prot = network_hdr.ipv6->nexthdr;

			if (transport_hdr.raw != exthdr)

				ipv6_skip_exthdr(skb, exthdr - skb->data,

						 &l4_prot, &frag_off);

			break;

		default:

			break;