From: Hannes Frederic Sowa <hannes@stressinduktion•org>
To: netdev@vger•kernel.org
Cc: vi0oss@gmail•com, steffen.klassert@secunet•com
Subject: [PATCH RFC] xfrm{4,6}: only report errors back to local sockets if we don't cross address family
Date: Mon, 29 Jul 2013 16:50:17 +0200 [thread overview]
Message-ID: <20130729145017.GD2490@order.stressinduktion.org> (raw)
xfrm6_local_error/xfrm4_tunnel_check_size report mtu errors back to a
socket in case it is locally generated. If the packet first traversed
a 6in4/4in6 tunnel before passing the xfrm layer, we could get a panic
because of address family type mismatch in the error reporting functions.
This bug fixes only the panic part of the excellent bug report
<https://bugzilla.kernel.org/show_bug.cgi?id=58691> by vi0oss.
It is unclear to me how to let these mtu change events travel up the
stack. A match on (skb->sk && (skb->dev | tunnel_types)) could be made
first and we forcefully decrease the mtu of that interface with a warning?
This seems to be fragile to me.
Reported-by: <vi0oss@gmail•com>
Cc: Steffen Klassert <steffen.klassert@secunet•com>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion•org>
---
net/ipv4/xfrm4_output.c | 4 ++--
net/ipv6/xfrm6_output.c | 3 +++
2 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/net/ipv4/xfrm4_output.c b/net/ipv4/xfrm4_output.c
index 327a617..61f6cae 100644
--- a/net/ipv4/xfrm4_output.c
+++ b/net/ipv4/xfrm4_output.c
@@ -32,10 +32,10 @@ static int xfrm4_tunnel_check_size(struct sk_buff *skb)
dst = skb_dst(skb);
mtu = dst_mtu(dst);
if (skb->len > mtu) {
- if (skb->sk)
+ if (skb->sk && skb->sk->sk_family == AF_INET)
ip_local_error(skb->sk, EMSGSIZE, ip_hdr(skb)->daddr,
inet_sk(skb->sk)->inet_dport, mtu);
- else
+ else if (!skb->sk)
icmp_send(skb, ICMP_DEST_UNREACH,
ICMP_FRAG_NEEDED, htonl(mtu));
ret = -EMSGSIZE;
diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
index 8755a30..29f6db7 100644
--- a/net/ipv6/xfrm6_output.c
+++ b/net/ipv6/xfrm6_output.c
@@ -59,6 +59,9 @@ static void xfrm6_local_error(struct sk_buff *skb, u32 mtu)
struct flowi6 fl6;
struct sock *sk = skb->sk;
+ if (sk->sk_family != AF_INET6)
+ return;
+
fl6.fl6_dport = inet_sk(sk)->inet_dport;
fl6.daddr = ipv6_hdr(skb)->daddr;
--
1.8.3.1
next reply other threads:[~2013-07-29 14:50 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-07-29 14:50 Hannes Frederic Sowa [this message]
2013-07-30 8:21 ` [PATCH RFC] xfrm{4,6}: only report errors back to local sockets if we don't cross address family Steffen Klassert
2013-07-30 8:30 ` Hannes Frederic Sowa
2013-07-30 10:26 ` Steffen Klassert
2013-07-30 10:40 ` Hannes Frederic Sowa
2013-07-31 0:01 ` David Miller
2013-08-01 8:11 ` Hannes Frederic Sowa
2013-08-01 10:05 ` Steffen Klassert
2013-08-08 22:44 ` Hannes Frederic Sowa
2013-08-08 22:57 ` Eric Dumazet
2013-08-08 23:06 ` Hannes Frederic Sowa
2013-08-10 16:16 ` Hannes Frederic Sowa
2013-08-12 5:54 ` Steffen Klassert
2013-08-13 0:48 ` [PATCH net-next] xfrm: make local error reporting more robust Hannes Frederic Sowa
2013-08-13 1:56 ` [PATCH net-next v2] " Hannes Frederic Sowa
2013-08-13 23:35 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20130729145017.GD2490@order.stressinduktion.org \
--to=hannes@stressinduktion$(echo .)org \
--cc=netdev@vger$(echo .)kernel.org \
--cc=steffen.klassert@secunet$(echo .)com \
--cc=vi0oss@gmail$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox