Skip to contentSkip to conversation

tap: call skb_probe_transport_header after setting skb->dev

PATCH In review Willem de Bruijn 3 participants 3 messages Dec 30, 2018 – Jan 7, 2019

Subsystems (3)
Networking Network drivers TUN/TAP driver
lore
Share & tools
lore

Willem de Bruijn

author maintainer
#0 lore raw

PATCH 1/1 tap: call skb_probe_transport_header after setting skb->dev

From: Willem de Bruijn <[email protected]>

The BPF flow dissector expects either skb->sk or skb->dev set on all skbs. Delay flow dissection until after skb->dev is set.

This requires calling from within an rcu read-side critical section. That is fine, see also the call from tun_xdp_one.

Fixes d0e13a1488ad ("flow_dissector: lookup netns by skb->sk if skb->dev is NULL")
Reported-by Christian Borntraeger <[email protected]>
Signed-off-by Willem de Bruijn <[email protected]>
---
 drivers/net/tap.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/tap.c +1 -2
index 443b2694130c..c0b52e48f0e6 100644
@@ -1177,8 +1177,6 @@ static int tap_get_user_xdp(struct tap_queue *q, struct xdp_buff *xdp)
 			goto err_kfree;
 	}
 
-	skb_probe_transport_header(skb, ETH_HLEN);
-
 	/* Move network header to the right position for VLAN tagged packets */
 	if ((skb->protocol == htons(ETH_P_8021Q) ||
 	     skb->protocol == htons(ETH_P_8021AD)) &&

@@ -1189,6 +1187,7 @@ static int tap_get_user_xdp(struct tap_queue *q, struct xdp_buff *xdp)
 	tap = rcu_dereference(q->tap);
 	if (tap) {
 		skb->dev = tap->dev;
+		skb_probe_transport_header(skb, ETH_HLEN);
 		dev_queue_xmit(skb);
 	} else {
 		kfree_skb(skb);
Signature · 1 line
2.20.1.415.g653613c723-goog
maintainer
#1 lore raw

From: Willem de Bruijn <[email protected]>
Date: Sun, 30 Dec 2018 17:21:05 -0500

Quoted 11 lines

From: Willem de Bruijn <[email protected]>

The BPF flow dissector expects either skb->sk or skb->dev set on all skbs. Delay flow dissection until after skb->dev is set.

This requires calling from within an rcu read-side critical section. That is fine, see also the call from tun_xdp_one.

Fixes d0e13a1488ad ("flow_dissector: lookup netns by skb->sk if skb->dev is NULL")
Reported-by Christian Borntraeger <[email protected]>
Signed-off-by Willem de Bruijn <[email protected]>

Applied and queued up for -stable.

Tested-by on v1 1/1
#2 lore raw
In reply to Willem de Bruijn
Quoted 11 lines · Willem de Bruijn

From: Willem de Bruijn <[email protected]>

The BPF flow dissector expects either skb->sk or skb->dev set on all skbs. Delay flow dissection until after skb->dev is set.

This requires calling from within an rcu read-side critical section. That is fine, see also the call from tun_xdp_one.

Fixes d0e13a1488ad ("flow_dissector: lookup netns by skb->sk if skb->dev is NULL")
Reported-by Christian Borntraeger <[email protected]>
Signed-off-by Willem de Bruijn <[email protected]>

Already too late, but

Tested-by Christian Borntraeger <[email protected]>
Quoted 26 lines
---
 drivers/net/tap.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/tap.c +1 -2
index 443b2694130c..c0b52e48f0e6 100644
@@ -1177,8 +1177,6 @@ static int tap_get_user_xdp(struct tap_queue *q, struct xdp_buff *xdp)
 			goto err_kfree;
 	}
 
-	skb_probe_transport_header(skb, ETH_HLEN);
-
 	/* Move network header to the right position for VLAN tagged packets */
 	if ((skb->protocol == htons(ETH_P_8021Q) ||
 	     skb->protocol == htons(ETH_P_8021AD)) &&

@@ -1189,6 +1187,7 @@ static int tap_get_user_xdp(struct tap_queue *q, struct xdp_buff *xdp)
 	tap = rcu_dereference(q->tap);
 	if (tap) {
 		skb->dev = tap->dev;
+		skb_probe_transport_header(skb, ETH_HLEN);
 		dev_queue_xmit(skb);
 	} else {
 		kfree_skb(skb);