linux/net/dsa
Jakob Unterwurzacher ba54bce747 net: dsa: microchip: linearize skb for tail-tagging switches
The pointer arithmentic for accessing the tail tag only works
for linear skbs.

For nonlinear skbs, it reads uninitialized memory inside the
skb headroom, essentially randomizing the tag. I have observed
it gets set to 6 most of the time.

Example where ksz9477_rcv thinks that the packet from port 1 comes from port 6
(which does not exist for the ksz9896 that's in use), dropping the packet.
Debug prints added by me (not included in this patch):

	[  256.645337] ksz9477_rcv:323 tag0=6
	[  256.645349] skb len=47 headroom=78 headlen=0 tailroom=0
	               mac=(64,14) mac_len=14 net=(78,0) trans=78
	               shinfo(txflags=0 nr_frags=1 gso(size=0 type=0 segs=0))
	               csum(0x0 start=0 offset=0 ip_summed=0 complete_sw=0 valid=0 level=0)
	               hash(0x0 sw=0 l4=0) proto=0x00f8 pkttype=1 iif=3
	               priority=0x0 mark=0x0 alloc_cpu=0 vlan_all=0x0
	               encapsulation=0 inner(proto=0x0000, mac=0, net=0, trans=0)
	[  256.645377] dev name=end1 feat=0x0002e10200114bb3
	[  256.645386] skb headroom: 00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
	[  256.645395] skb headroom: 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
	[  256.645403] skb headroom: 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
	[  256.645411] skb headroom: 00000030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
	[  256.645420] skb headroom: 00000040: ff ff ff ff ff ff 00 1c 19 f2 e2 db 08 06
	[  256.645428] skb frag:     00000000: 00 01 08 00 06 04 00 01 00 1c 19 f2 e2 db 0a 02
	[  256.645436] skb frag:     00000010: 00 83 00 00 00 00 00 00 0a 02 a0 2f 00 00 00 00
	[  256.645444] skb frag:     00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01
	[  256.645452] ksz_common_rcv:92 dsa_conduit_find_user returned NULL

Call skb_linearize before trying to access the tag.

This patch fixes ksz9477_rcv which is used by the ksz9896 I have at
hand, and also applies the same fix to ksz8795_rcv which seems to have
the same problem.

Signed-off-by: Jakob Unterwurzacher <jakob.unterwurzacher@cherry.de>
CC: stable@vger.kernel.org
Fixes: 016e43a26b ("net: dsa: ksz: Add KSZ8795 tag code")
Fixes: 8b8010fb78 ("dsa: add support for Microchip KSZ tail tagging")
Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
Link: https://patch.msgid.link/20250515072920.2313014-1-jakob.unterwurzacher@cherry.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-05-16 16:00:17 -07:00
..
conduit.c net: move misc netdev_lock flavors to a separate header 2025-03-08 09:06:50 -08:00
conduit.h net: dsa: Use conduit and user terms 2023-10-24 13:08:14 -07:00
devlink.c net: dsa: replace devlink resource registration calls by devl_ variants 2024-10-29 16:52:57 -07:00
devlink.h net: dsa: move rest of devlink setup/teardown to devlink.c 2022-11-22 20:41:47 -08:00
dsa.c net: dsa: free routing table on probe failure 2025-04-16 18:14:44 -07:00
dsa.h net: dsa: Use conduit and user terms 2023-10-24 13:08:14 -07:00
Kconfig net: dsa: vsc73xx: introduce tag 8021q for vsc73xx 2024-07-15 06:55:15 -07:00
Makefile net: dsa: vsc73xx: introduce tag 8021q for vsc73xx 2024-07-15 06:55:15 -07:00
netlink.c net: dsa: Rename IFLA_DSA_MASTER to IFLA_DSA_CONDUIT 2023-10-24 13:08:14 -07:00
netlink.h net: dsa: kill off dsa_priv.h 2022-11-22 20:41:54 -08:00
port.c net: dsa: provide implementation of .support_eee() 2024-12-11 20:29:38 -08:00
port.h net: dsa: Use conduit and user terms 2023-10-24 13:08:14 -07:00
stubs.c net: dsa: replace NETDEV_PRE_CHANGE_HWTSTAMP notifier with a stub 2023-04-09 15:35:49 +01:00
switch.c net: dsa: Use conduit and user terms 2023-10-24 13:08:14 -07:00
switch.h net: dsa: Use conduit and user terms 2023-10-24 13:08:14 -07:00
tag.c net: dsa: provide a software untagging function on RX for VLAN-aware bridges 2024-08-16 09:59:32 +01:00
tag.h net: dsa: restore dsa_software_vlan_untag() ability to operate on VLAN-untagged traffic 2024-12-18 19:22:36 -08:00
tag_8021q.c net: dsa: avoid refcount warnings when ds->ops->tag_8021q_vlan_del() fails 2025-04-16 18:14:44 -07:00
tag_8021q.h net: dsa: tag_sja1105: refactor skb->dev assignment to dsa_tag_8021q_find_user() 2024-07-15 06:55:15 -07:00
tag_ar9331.c net: fill in MODULE_DESCRIPTION()s for DSA tags 2024-01-05 08:06:19 -08:00
tag_brcm.c net: fill in MODULE_DESCRIPTION()s for DSA tags 2024-01-05 08:06:19 -08:00
tag_dsa.c net: fill in MODULE_DESCRIPTION()s for DSA tags 2024-01-05 08:06:19 -08:00
tag_gswip.c net: fill in MODULE_DESCRIPTION()s for DSA tags 2024-01-05 08:06:19 -08:00
tag_hellcreek.c net: fill in MODULE_DESCRIPTION()s for DSA tags 2024-01-05 08:06:19 -08:00
tag_ksz.c net: dsa: microchip: linearize skb for tail-tagging switches 2025-05-16 16:00:17 -07:00
tag_lan9303.c net: fill in MODULE_DESCRIPTION()s for DSA tags 2024-01-05 08:06:19 -08:00
tag_mtk.c net: fill in MODULE_DESCRIPTION()s for DSA tags 2024-01-05 08:06:19 -08:00
tag_none.c net: fill in MODULE_DESCRIPTION()s for DSA tags 2024-01-05 08:06:19 -08:00
tag_ocelot.c net: mscc: ocelot: use ocelot_xmit_get_vlan_info() also for FDMA and register injection 2024-08-16 09:59:32 +01:00
tag_ocelot_8021q.c Kthreads affinity follow either of 4 existing different patterns: 2025-01-21 17:10:05 -08:00
tag_qca.c net: fill in MODULE_DESCRIPTION()s for DSA tags 2024-01-05 08:06:19 -08:00
tag_rtl4_a.c net: fill in MODULE_DESCRIPTION()s for DSA tags 2024-01-05 08:06:19 -08:00
tag_rtl8_4.c net: fill in MODULE_DESCRIPTION()s for DSA tags 2024-01-05 08:06:19 -08:00
tag_rzn1_a5psw.c net: fill in MODULE_DESCRIPTION()s for DSA tags 2024-01-05 08:06:19 -08:00
tag_sja1105.c treewide: Introduce kthread_run_worker[_on_cpu]() 2025-01-08 18:15:03 +01:00
tag_trailer.c net: fill in MODULE_DESCRIPTION()s for DSA tags 2024-01-05 08:06:19 -08:00
tag_vsc73xx_8021q.c net: dsa: vsc73xx: introduce tag 8021q for vsc73xx 2024-07-15 06:55:15 -07:00
tag_xrs700x.c net: fill in MODULE_DESCRIPTION()s for DSA tags 2024-01-05 08:06:19 -08:00
trace.c net: dsa: add trace points for FDB/MDB operations 2023-04-12 08:36:07 +01:00
trace.h tracing/treewide: Remove second parameter of __assign_str() 2024-05-22 20:14:47 -04:00
user.c bpf: Add BPF_SOCK_OPS_TSTAMP_SND_HW_CB callback 2025-02-20 14:29:36 -08:00
user.h net: dsa: update the unicast MAC address when changing conduit 2024-06-10 13:48:06 +01:00