diff options
| author | Antoine Tenart <atenart@kernel.org> | 2020-11-30 17:19:11 +0100 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2020-12-02 11:16:12 -0800 |
| commit | 832ba596494b2c9eac7760259eff2d8b7dcad0ee (patch) | |
| tree | 8027b38b050651d996b025aabcbdbbd05b52ad12 /drivers/net/ethernet/freescale/dpaa | |
| parent | 4179b00c04d18ea7013f68d578d80f3c9d13150a (diff) | |
net: ip6_gre: set dev->hard_header_len when using header_ops
syzkaller managed to crash the kernel using an NBMA ip6gre interface. I
could reproduce it creating an NBMA ip6gre interface and forwarding
traffic to it:
skbuff: skb_under_panic: text:ffffffff8250e927 len:148 put:44 head:ffff8c03c7a33
------------[ cut here ]------------
kernel BUG at net/core/skbuff.c:109!
Call Trace:
skb_push+0x10/0x10
ip6gre_header+0x47/0x1b0
neigh_connected_output+0xae/0xf0
ip6gre tunnel provides its own header_ops->create, and sets it
conditionally when initializing the tunnel in NBMA mode. When
header_ops->create is used, dev->hard_header_len should reflect the
length of the header created. Otherwise, when not used,
dev->needed_headroom should be used.
Fixes: eb95f52fc72d ("net: ipv6_gre: Fix GRO to work on IPv6 over GRE tap")
Cc: Maria Pasechnik <mariap@mellanox.com>
Signed-off-by: Antoine Tenart <atenart@kernel.org>
Link: https://lore.kernel.org/r/20201130161911.464106-1-atenart@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'drivers/net/ethernet/freescale/dpaa')
0 files changed, 0 insertions, 0 deletions