Skip to contentSkip to conversation

net: sched: act_csum: validate nested VLAN headers

PATCH Applied Ren Wei 3 participants 3 messages Apr 2 – Apr 3 1 message not in the archive

Subsystems (3)
Networking Network drivers Traffic control (tc)
lore
Share & tools
lore

A message that is not in the archive (sent off-list or not yet received): [email protected]

Ren Wei

author
#1 lore raw

PATCH 1/1 net: sched: act_csum: validate nested VLAN headers

From: Ruide Cao <[email protected]>

tcf_csum_act() walks nested VLAN headers directly from skb->data when an skb still carries in-payload VLAN tags. The current code reads vlan->h_vlan_encapsulated_proto and then pulls VLAN_HLEN bytes without first ensuring that the full VLAN header is present in the linear area.

If only part of an inner VLAN header is linearized, accessing h_vlan_encapsulated_proto reads past the linear area, and the following skb_pull(VLAN_HLEN) may violate skb invariants.

Fix this by requiring pskb_may_pull(skb, VLAN_HLEN) before accessing and pulling each nested VLAN header. If the header still is not fully available, drop the packet through the existing error path.

Fixes 2ecba2d1e45b ("net: sched: act_csum: Fix csum calc for tagged packets")
Reported-by Yifan Wu <[email protected]>
Reported-by Juefei Pu <[email protected]>
Co-developed-by Yuan Tan <[email protected]>
Signed-off-by Yuan Tan <[email protected]>
Suggested-by Xin Liu <[email protected]>
Tested-by Ren Wei <[email protected]>
Signed-off-by Ruide Cao <[email protected]>
Signed-off-by Ren Wei <[email protected]>
---
 net/sched/act_csum.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)
net/sched/act_csum.c +5 -1
index 213e1ce9d2da..a9e4635d899e 100644
@@ -604,8 +604,12 @@ TC_INDIRECT_SCOPE int tcf_csum_act(struct sk_buff *skb,
 			protocol = skb->protocol;
 			orig_vlan_tag_present = true;
 		} else {
-			struct vlan_hdr *vlan = (struct vlan_hdr *)skb->data;
+			struct vlan_hdr *vlan;
 
+			if (!pskb_may_pull(skb, VLAN_HLEN))
+				goto drop;
+
+			vlan = (struct vlan_hdr *)skb->data;
 			protocol = vlan->h_vlan_encapsulated_proto;
 			skb_pull(skb, VLAN_HLEN);
 			skb_reset_network_header(skb);
Signature · 1 line
2.34.1
reviewer Reviewed-by on v1 1/1
#2 lore raw
Quoted 15 lines · Ren Wei

From: Ruide Cao <[email protected]>

tcf_csum_act() walks nested VLAN headers directly from skb->data when an skb still carries in-payload VLAN tags. The current code reads vlan->h_vlan_encapsulated_proto and then pulls VLAN_HLEN bytes without first ensuring that the full VLAN header is present in the linear area.

If only part of an inner VLAN header is linearized, accessing h_vlan_encapsulated_proto reads past the linear area, and the following skb_pull(VLAN_HLEN) may violate skb invariants.

Fix this by requiring pskb_may_pull(skb, VLAN_HLEN) before accessing and pulling each nested VLAN header. If the header still is not fully available, drop the packet through the existing error path.

Quoted 9 lines
Fixes 2ecba2d1e45b ("net: sched: act_csum: Fix csum calc for tagged packets")
Reported-by Yifan Wu <[email protected]>
Reported-by Juefei Pu <[email protected]>
Co-developed-by Yuan Tan <[email protected]>
Signed-off-by Yuan Tan <[email protected]>
Suggested-by Xin Liu <[email protected]>
Tested-by Ren Wei <[email protected]>
Signed-off-by Ruide Cao <[email protected]>
Signed-off-by Ren Wei <[email protected]>
Reviewed-by Simon Horman <[email protected]>
CI Applied
#3 lore raw
In reply to Ren Wei
This patch was applied to netdev/net.git (main) by Jakub Kicinski <[email protected]>:

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <[email protected]>:

Quoted 8 lines · On Thu, 2 Apr 2026 22:46:20 +0800 you wrote:

From: Ruide Cao <[email protected]>

tcf_csum_act() walks nested VLAN headers directly from skb->data when an skb still carries in-payload VLAN tags. The current code reads vlan->h_vlan_encapsulated_proto and then pulls VLAN_HLEN bytes without first ensuring that the full VLAN header is present in the linear area.

[...]

Here is the summary with links:
- [net,1/1] net: sched: act_csum: validate nested VLAN headers

    https://git.kernel.org/netdev/net/c/c842743d073b

You are awesome, thank you!

Signature · 2 lines
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html