linux/net/openvswitch
Jiri Benc 2ba5af42a7 openvswitch: fix panic with multiple vlan headers
When there are multiple vlan headers present in a received frame, the first
one is put into vlan_tci and protocol is set to ETH_P_8021Q. Anything in the
skb beyond the VLAN TPID may be still non-linear, including the inner TCI
and ethertype. While ovs_flow_extract takes care of IP and IPv6 headers, it
does nothing with ETH_P_8021Q. Later, if OVS_ACTION_ATTR_POP_VLAN is
executed, __pop_vlan_tci pulls the next vlan header into vlan_tci.

This leads to two things:

1. Part of the resulting ethernet header is in the non-linear part of the
   skb. When eth_type_trans is called later as the result of
   OVS_ACTION_ATTR_OUTPUT, kernel BUGs in __skb_pull. Also, __pop_vlan_tci
   is in fact accessing random data when it reads past the TPID.

2. network_header points into the ethernet header instead of behind it.
   mac_len is set to a wrong value (10), too.

Reported-by: Yulong Pei <ypei@redhat.com>
Signed-off-by: Jiri Benc <jbenc@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-08-22 11:24:04 -07:00
..
Kconfig openvswitch: Add SCTP support 2013-08-26 14:03:13 -07:00
Makefile openvswitch: Restructure datapath.c and flow.c 2013-10-03 18:16:47 -07:00
actions.c openvswitch: fix panic with multiple vlan headers 2014-08-22 11:24:04 -07:00
datapath.c openvswitch: fix duplicate #include headers 2014-08-07 16:02:57 -07:00
datapath.h net: Remove unlikely() for WARN_ON() conditions 2014-07-30 17:41:47 -07:00
dp_notify.c genetlink: make multicast groups const, prevent abuse 2013-11-19 16:39:06 -05:00
flow.c openvswitch: Fix tracking of flags seen in TCP flows. 2014-06-29 14:10:51 -07:00
flow.h openvswitch: Fix tracking of flags seen in TCP flows. 2014-06-29 14:10:51 -07:00
flow_netlink.c openvswitch: Compact sw_flow_key. 2014-05-22 16:27:34 -07:00
flow_netlink.h openvswitch: Remove 5-tuple optimization. 2014-05-16 13:40:29 -07:00
flow_table.c openvswitch: Use exact lookup for flow_get and flow_del. 2014-06-30 20:47:15 -07:00
flow_table.h openvswitch: Use exact lookup for flow_get and flow_del. 2014-06-30 20:47:15 -07:00
vport-gre.c openvswitch: supply a dummy err_handler of gre_cisco_protocol to prevent kernel crash 2014-06-29 14:10:48 -07:00
vport-internal_dev.c openvswitch: Enable tunnel GSO for OVS bridge. 2014-07-24 01:15:04 -07:00
vport-internal_dev.h openvswitch: introduce rtnl ops stub 2014-07-01 14:40:17 -07:00
vport-netdev.c openvswitch: fix vport-netdev unregister 2013-10-16 14:50:22 -07:00
vport-netdev.h openvswitch: fix vport-netdev unregister 2013-10-16 14:50:22 -07:00
vport-vxlan.c vxlan: Call udp_flow_src_port 2014-07-07 21:14:21 -07:00
vport.c openvswitch: Fix memory leak in ovs_vport_alloc() error path 2014-08-13 20:04:46 -07:00
vport.h openvswitch: Allow each vport to have an array of 'port_id's. 2014-07-24 01:15:04 -07:00