mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2025-11-27 01:11:31 +00:00
2ba5af42a7
When there are multiple vlan headers present in a received frame, the first one is put into vlan_tci and protocol is set to ETH_P_8021Q. Anything in the skb beyond the VLAN TPID may be still non-linear, including the inner TCI and ethertype. While ovs_flow_extract takes care of IP and IPv6 headers, it does nothing with ETH_P_8021Q. Later, if OVS_ACTION_ATTR_POP_VLAN is executed, __pop_vlan_tci pulls the next vlan header into vlan_tci. This leads to two things: 1. Part of the resulting ethernet header is in the non-linear part of the skb. When eth_type_trans is called later as the result of OVS_ACTION_ATTR_OUTPUT, kernel BUGs in __skb_pull. Also, __pop_vlan_tci is in fact accessing random data when it reads past the TPID. 2. network_header points into the ethernet header instead of behind it. mac_len is set to a wrong value (10), too. Reported-by: Yulong Pei <ypei@redhat.com> Signed-off-by: Jiri Benc <jbenc@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net> |
||
|---|---|---|
| .. | ||
| actions.c | ||
| datapath.c | ||
| datapath.h | ||
| dp_notify.c | ||
| flow.c | ||
| flow.h | ||
| flow_netlink.c | ||
| flow_netlink.h | ||
| flow_table.c | ||
| flow_table.h | ||
| Kconfig | ||
| Makefile | ||
| vport-gre.c | ||
| vport-internal_dev.c | ||
| vport-internal_dev.h | ||
| vport-netdev.c | ||
| vport-netdev.h | ||
| vport-vxlan.c | ||
| vport.c | ||
| vport.h | ||