LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Ronak Doshi <doshir@vmware.com>,
	Guolin Yang <gyang@vmware.com>, Louis Luo <llouis@vmware.com>,
	"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 4.16 34/81] vmxnet3: fix incorrect dereference when rxvlan is disabled
Date: Fri, 27 Apr 2018 15:58:36 +0200	[thread overview]
Message-ID: <20180427135744.984141762@linuxfoundation.org> (raw)
In-Reply-To: <20180427135743.216853156@linuxfoundation.org>

4.16-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ronak Doshi <doshir@vmware.com>


[ Upstream commit 65ec0bd1c7c14522670a5294de35710fb577a7fd ]

vmxnet3_get_hdr_len() is used to calculate the header length which in
turn is used to calculate the gso_size for skb. When rxvlan offload is
disabled, vlan tag is present in the header and the function references
ip header from sizeof(ethhdr) and leads to incorrect pointer reference.

This patch fixes this issue by taking sizeof(vlan_ethhdr) into account
if vlan tag is present and correctly references the ip hdr.

Signed-off-by: Ronak Doshi <doshir@vmware.com>
Acked-by: Guolin Yang <gyang@vmware.com>
Acked-by: Louis Luo <llouis@vmware.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/vmxnet3/vmxnet3_drv.c |   17 +++++++++++++----
 drivers/net/vmxnet3/vmxnet3_int.h |    4 ++--
 2 files changed, 15 insertions(+), 6 deletions(-)

--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -1218,6 +1218,7 @@ vmxnet3_get_hdr_len(struct vmxnet3_adapt
 	union {
 		void *ptr;
 		struct ethhdr *eth;
+		struct vlan_ethhdr *veth;
 		struct iphdr *ipv4;
 		struct ipv6hdr *ipv6;
 		struct tcphdr *tcp;
@@ -1228,16 +1229,24 @@ vmxnet3_get_hdr_len(struct vmxnet3_adapt
 	if (unlikely(sizeof(struct iphdr) + sizeof(struct tcphdr) > maplen))
 		return 0;
 
+	if (skb->protocol == cpu_to_be16(ETH_P_8021Q) ||
+	    skb->protocol == cpu_to_be16(ETH_P_8021AD))
+		hlen = sizeof(struct vlan_ethhdr);
+	else
+		hlen = sizeof(struct ethhdr);
+
 	hdr.eth = eth_hdr(skb);
 	if (gdesc->rcd.v4) {
-		BUG_ON(hdr.eth->h_proto != htons(ETH_P_IP));
-		hdr.ptr += sizeof(struct ethhdr);
+		BUG_ON(hdr.eth->h_proto != htons(ETH_P_IP) &&
+		       hdr.veth->h_vlan_encapsulated_proto != htons(ETH_P_IP));
+		hdr.ptr += hlen;
 		BUG_ON(hdr.ipv4->protocol != IPPROTO_TCP);
 		hlen = hdr.ipv4->ihl << 2;
 		hdr.ptr += hdr.ipv4->ihl << 2;
 	} else if (gdesc->rcd.v6) {
-		BUG_ON(hdr.eth->h_proto != htons(ETH_P_IPV6));
-		hdr.ptr += sizeof(struct ethhdr);
+		BUG_ON(hdr.eth->h_proto != htons(ETH_P_IPV6) &&
+		       hdr.veth->h_vlan_encapsulated_proto != htons(ETH_P_IPV6));
+		hdr.ptr += hlen;
 		/* Use an estimated value, since we also need to handle
 		 * TSO case.
 		 */
--- a/drivers/net/vmxnet3/vmxnet3_int.h
+++ b/drivers/net/vmxnet3/vmxnet3_int.h
@@ -69,10 +69,10 @@
 /*
  * Version numbers
  */
-#define VMXNET3_DRIVER_VERSION_STRING   "1.4.13.0-k"
+#define VMXNET3_DRIVER_VERSION_STRING   "1.4.14.0-k"
 
 /* a 32-bit int, each byte encode a verion number in VMXNET3_DRIVER_VERSION */
-#define VMXNET3_DRIVER_VERSION_NUM      0x01040d00
+#define VMXNET3_DRIVER_VERSION_NUM      0x01040e00
 
 #if defined(CONFIG_PCI_MSI)
 	/* RSS only makes sense if MSI-X is supported. */

  parent reply	other threads:[~2018-04-27 14:29 UTC|newest]

Thread overview: 88+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-04-27 13:58 [PATCH 4.16 00/81] 4.16.6-stable review Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 01/81] Revert "pinctrl: intel: Initialize GPIO properly when used through irqchip" Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 02/81] drm: bridge: dw-hdmi: Fix overflow workaround for Amlogic Meson GX SoCs Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 03/81] i40e: Fix attach VF to VM issue Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 04/81] tpm: cmd_ready command can be issued only after granting locality Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 05/81] tpm: tpm-interface: fix tpm_transmit/_cmd kdoc Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 06/81] tpm: add retry logic Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 07/81] Revert "ath10k: send (re)assoc peer command when NSS changed" Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 08/81] bonding: do not set slave_dev npinfo before slave_enable_netpoll in bond_enslave Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 09/81] docs: ip-sysctl.txt: fix name of some ipv6 variables Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 10/81] ipv6: add RTA_TABLE and RTA_PREFSRC to rtm_ipv6_policy Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 11/81] ipv6: sr: fix NULL pointer dereference in seg6_do_srh_encap()- v4 pkts Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 12/81] KEYS: DNS: limit the length of option strings Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 13/81] l2tp: check sockaddr length in pppol2tp_connect() Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 14/81] llc: delete timers synchronously in llc_sk_free() Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 15/81] net: af_packet: fix race in PACKET_{R|T}X_RING Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 16/81] net: fix deadlock while clearing neighbor proxy table Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 17/81] net: mvpp2: Fix DMA address mask size Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 18/81] net: qmi_wwan: add Wistron Neweb D19Q1 Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 19/81] net/smc: fix shutdown in state SMC_LISTEN Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 20/81] net: stmmac: Disable ACS Feature for GMAC >= 4 Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 21/81] packet: fix bitfield update race Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 22/81] pppoe: check sockaddr length in pppoe_connect() Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 23/81] Revert "macsec: missing dev_put() on error in macsec_newlink()" Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 24/81] sctp: do not check port in sctp_inet6_cmp_addr Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 25/81] strparser: Do not call mod_delayed_work with a timeout of LONG_MAX Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 26/81] strparser: Fix incorrect strp->need_bytes value Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 27/81] tcp: clear tp->packets_out when purging write queue Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 28/81] tcp: dont read out-of-bounds opsize Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 29/81] tcp: md5: reject TCP_MD5SIG or TCP_MD5SIG_EXT on established sockets Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 30/81] team: avoid adding twice the same option to the event list Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 31/81] team: fix netconsole setup over team Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 32/81] tipc: add policy for TIPC_NLA_NET_ADDR Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 33/81] vlan: Fix reading memory beyond skb->tail in skb_vlan_tagged_multi Greg Kroah-Hartman
2018-04-27 13:58 ` Greg Kroah-Hartman [this message]
2018-04-27 13:58 ` [PATCH 4.16 35/81] amd-xgbe: Add pre/post auto-negotiation phy hooks Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 36/81] amd-xgbe: Improve KR auto-negotiation and training Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 37/81] amd-xgbe: Only use the SFP supported transceiver signals Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 38/81] net: sched: ife: signal not finding metaid Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 39/81] net: sched: ife: handle malformed tlv length Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 40/81] net: sched: ife: check on metadata length Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 41/81] l2tp: hold reference on tunnels in netlink dumps Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 42/81] l2tp: hold reference on tunnels printed in pppol2tp proc file Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 43/81] l2tp: hold reference on tunnels printed in l2tp/tunnels debugfs file Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 44/81] l2tp: fix {pppol2tp, l2tp_dfs}_seq_stop() in case of seq_file overflow Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 45/81] llc: hold llc_sap before release_sock() Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 46/81] llc: fix NULL pointer deref for SOCK_ZAPPED Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 47/81] s390/qeth: fix error handling in adapter command callbacks Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 48/81] s390/qeth: avoid control IO completion stalls Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 49/81] s390/qeth: handle failure on workqueue creation Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 50/81] net: ethernet: ti: cpsw: fix tx vlan priority mapping Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 51/81] net: validate attribute sizes in neigh_dump_table() Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 52/81] bnxt_en: Fix memory fault in bnxt_ethtool_init() Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 53/81] virtio-net: add missing virtqueue kick when flushing packets Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 54/81] VSOCK: make af_vsock.ko removable again Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 55/81] net: aquantia: Regression on reset with 1.x firmware Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 56/81] tun: fix vlan packet truncation Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.16 57/81] net: aquantia: oops when shutdown on already stopped device Greg Kroah-Hartman
2018-04-27 13:59 ` [PATCH 4.16 58/81] virtio_net: split out ctrl buffer Greg Kroah-Hartman
2018-04-27 13:59 ` [PATCH 4.16 59/81] virtio_net: fix adding vids on big-endian Greg Kroah-Hartman
2018-04-27 13:59 ` [PATCH 4.16 60/81] Revert "mm/hmm: fix header file if/else/endif maze" Greg Kroah-Hartman
2018-04-27 13:59 ` [PATCH 4.16 61/81] commoncap: Handle memory allocation failure Greg Kroah-Hartman
2018-04-27 13:59 ` [PATCH 4.16 62/81] scsi: mptsas: Disable WRITE SAME Greg Kroah-Hartman
2018-04-27 13:59 ` [PATCH 4.16 63/81] cdrom: information leak in cdrom_ioctl_media_changed() Greg Kroah-Hartman
2018-04-27 13:59 ` [PATCH 4.16 64/81] fsnotify: Fix fsnotify_mark_connector race Greg Kroah-Hartman
2018-04-27 13:59 ` [PATCH 4.16 65/81] m68k/mac: Dont remap SWIM MMIO region Greg Kroah-Hartman
2018-04-27 13:59 ` [PATCH 4.16 66/81] block/swim: Check drive type Greg Kroah-Hartman
2018-04-27 13:59 ` [PATCH 4.16 67/81] block/swim: Dont log an error message for an invalid ioctl Greg Kroah-Hartman
2018-04-27 13:59 ` [PATCH 4.16 68/81] block/swim: Remove extra put_disk() call from error path Greg Kroah-Hartman
2018-04-27 13:59 ` [PATCH 4.16 69/81] block/swim: Rename macros to avoid inconsistent inverted logic Greg Kroah-Hartman
2018-04-27 13:59 ` [PATCH 4.16 70/81] block/swim: Select appropriate drive on device open Greg Kroah-Hartman
2018-04-27 13:59 ` [PATCH 4.16 71/81] block/swim: Fix array bounds check Greg Kroah-Hartman
2018-04-27 13:59 ` [PATCH 4.16 72/81] block/swim: Fix IO error at end of medium Greg Kroah-Hartman
2018-04-27 13:59 ` [PATCH 4.16 73/81] tracing: Fix missing tab for hwlat_detector print format Greg Kroah-Hartman
2018-04-27 13:59 ` [PATCH 4.16 74/81] hwmon: (k10temp) Add temperature offset for Ryzen 2700X Greg Kroah-Hartman
2018-04-27 13:59 ` [PATCH 4.16 75/81] hwmon: (k10temp) Add support for AMD Ryzen w/ Vega graphics Greg Kroah-Hartman
2018-04-27 13:59 ` [PATCH 4.16 76/81] s390/cio: update chpid descriptor after resource accessibility event Greg Kroah-Hartman
2018-04-27 13:59 ` [PATCH 4.16 77/81] s390/dasd: fix IO error for newly defined devices Greg Kroah-Hartman
2018-04-27 13:59 ` [PATCH 4.16 78/81] s390/uprobes: implement arch_uretprobe_is_alive() Greg Kroah-Hartman
2018-04-27 13:59 ` [PATCH 4.16 79/81] s390/cpum_cf: rename IBM z13/z14 counter names Greg Kroah-Hartman
2018-04-27 13:59 ` [PATCH 4.16 80/81] kprobes: Fix random address output of blacklist file Greg Kroah-Hartman
2018-04-27 13:59 ` [PATCH 4.16 81/81] ACPI / video: Only default only_lcd to true on Win8-ready _desktops_ Greg Kroah-Hartman
2018-04-27 18:15 ` [PATCH 4.16 00/81] 4.16.6-stable review Shuah Khan
2018-04-27 20:41 ` Dan Rue
2018-04-28  5:50   ` Greg Kroah-Hartman
2018-04-27 20:44 ` kernelci.org bot
2018-04-28 14:32 ` Guenter Roeck
2018-04-28 15:52   ` Greg Kroah-Hartman

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20180427135744.984141762@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=davem@davemloft.net \
    --cc=doshir@vmware.com \
    --cc=gyang@vmware.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=llouis@vmware.com \
    --cc=stable@vger.kernel.org \
    --subject='Re: [PATCH 4.16 34/81] vmxnet3: fix incorrect dereference when rxvlan is disabled' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).