Patch "net/sched: act_vlan: Push skb->data to mac_header prior calling skb_vlan_*() functions" has been added to the 4.4-stable tree

This is a note to let you know that I've just added the patch titled

    net/sched: act_vlan: Push skb->data to mac_header prior calling skb_vlan_*() functions

to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
net-sched-act_vlan-push-skb-data-to-mac_header-prior-calling-skb_vlan_-functions.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Shmulik Ladkani <[email protected]>
Date: Thu, 29 Sep 2016 12:10:40 +0300
Subject: net/sched: act_vlan: Push skb->data to mac_header prior calling skb_vlan_*() functions

From: Shmulik Ladkani <[email protected]>

[ Upstream commit f39acc84aad10710e89835c60d3b6694c43a8dd9 ]

Generic skb_vlan_push/skb_vlan_pop functions don't properly handle the case where the input skb data pointer does not point at the mac header:

- They're doing push/pop, but fail to properly unwind data back to its original location.
For example, in the skb_vlan_push case, any subsequent 'skb_push(skb, skb->mac_len)' calls make the skb->data point 4 bytes BEFORE start of frame, leading to bogus frames that may be transmitted.

- They update rcsum per the added/removed 4 bytes tag. Alas if data is originally after the vlan/eth headers, then these bytes were already pulled out of the csum.

OTOH calling skb_vlan_push/skb_vlan_pop with skb->data at mac_header present no issues.

act_vlan is the only caller to skb_vlan_*() that has skb->data pointing at network header (upon ingress).
Other calles (ovs, bpf) already adjust skb->data at mac_header.

This patch fixes act_vlan to point to the mac_header prior calling skb_vlan_*() functions, as other callers do.

---
 include/net/sch_generic.h |    9 +++++++++
 net/sched/act_vlan.c      |    9 +++++++++
 2 files changed, 18 insertions(+)

@@ -408,6 +408,15 @@ bool tcf_destroy(struct tcf_proto *tp, b
 void tcf_destroy_chain(struct tcf_proto __rcu **fl);
 int skb_do_redirect(struct sk_buff *);
 
+static inline bool skb_at_tc_ingress(const struct sk_buff *skb)
+{
+#ifdef CONFIG_NET_CLS_ACT
+	return G_TC_AT(skb->tc_verd) & AT_INGRESS;
+#else
+	return false;
+#endif
+}
+
 /* Reset all TX qdiscs greater then index of a device.  */
 static inline void qdisc_reset_all_tx_gt(struct net_device *dev, unsigned int i)
 {

@@ -33,6 +33,12 @@ static int tcf_vlan(struct sk_buff *skb,
 	bstats_update(&v->tcf_bstats, skb);
 	action = v->tcf_action;
 
+	/* Ensure 'data' points at mac_header prior calling vlan manipulating
+	 * functions.
+	 */
+	if (skb_at_tc_ingress(skb))
+		skb_push_rcsum(skb, skb->mac_len);
+
 	switch (v->tcfv_action) {
 	case TCA_VLAN_ACT_POP:
 		err = skb_vlan_pop(skb);

@@ -54,6 +60,9 @@ drop:
 	action = TC_ACT_SHOT;
 	v->tcf_qstats.drops++;
 unlock:
+	if (skb_at_tc_ingress(skb))
+		skb_pull_rcsum(skb, skb->mac_len);
+
 	spin_unlock(&v->tcf_lock);
 	return action;
 }

Patches currently in stable-queue which might be from [email protected] are

queue-4.4/ip6_gre-fix-flowi6_proto-value-in-ip6gre_xmit_other.patch queue-4.4/net-sched-act_vlan-push-skb-data-to-mac_header-prior-calling-skb_vlan_-functions.patch