Commit b005c9ef authored Mar 09, 2021 by David S. Miller

Merge branch 'virtio_net-infinite-loop'



Balazs Nemeth says:

====================
net: prevent infinite loop caused by incorrect proto from virtio_net_hdr_set_proto

These patches prevent an infinite loop for gso packets with a protocol
from virtio net hdr that doesn't match the protocol in the packet.
Note that packets coming from a device without
header_ops->parse_protocol being implemented will not be caught by
the check in virtio_net_hdr_to_skb, but the infinite loop will still
be prevented by the check in the gso layer.

Changes from v2 to v3:
  - Remove unused *eth.
  - Use MPLS_HLEN to also check if the MPLS header length is a multiple
    of four.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

parents 286a8624 d348ede3

include/linux/virtio_net.h

+6 −1

Original line number	Diff line number	Diff line
		@@ -79,8 +79,13 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb,
		if (gso_type && skb->network_header) {
		struct flow_keys_basic keys;

		if (!skb->protocol)
		if (!skb->protocol) {
		__be16 protocol = dev_parse_header_protocol(skb);

		virtio_net_hdr_set_proto(skb, hdr);
		if (protocol && protocol != skb->protocol)
		return -EINVAL;
		}
		retry:
		if (!skb_flow_dissect_flow_keys_basic(NULL, skb, &keys,
		NULL, 0, 0, 0,

net/mpls/mpls_gso.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -14,6 +14,7 @@
		#include <linux/netdev_features.h>
		#include <linux/netdevice.h>
		#include <linux/skbuff.h>
		#include <net/mpls.h>

		static struct sk_buff mpls_gso_segment(struct sk_buff skb,
		netdev_features_t features)
		@@ -27,6 +28,8 @@ static struct sk_buff mpls_gso_segment(struct sk_buff skb,

		skb_reset_network_header(skb);
		mpls_hlen = skb_inner_network_header(skb) - skb_network_header(skb);
		if (unlikely(!mpls_hlen \|\| mpls_hlen % MPLS_HLEN))
		goto out;
		if (unlikely(!pskb_may_pull(skb, mpls_hlen)))
		goto out;