mbox series

[net,0/2] Fix vlan tag handling for vlan packets without ethernet headers

Message ID 1522317930-2951-1-git-send-email-makita.toshiaki@lab.ntt.co.jp
Headers show
Series Fix vlan tag handling for vlan packets without ethernet headers | expand

Message

Toshiaki Makita March 29, 2018, 10:05 a.m. UTC 
Eric Dumazet reported syzbot found a new bug which leads to underflow of
size argument of memmove(), causing crash[1]. This can be triggered by tun
devices.

The underflow happened because skb_vlan_untag() did not expect vlan packets
without ethernet headers, and tun can produce such packets.
I also checked vlan_insert_inner_tag() and found a similar bug.

This series fixes these problems.

[1] https://marc.info/?l=linux-netdev&m=152221753920510&w=2

Toshiaki Makita (2):
  net: Fix untag for vlan packets without ethernet header
  vlan: Fix vlan insertion for packets without ethernet header

 include/linux/if_vlan.h | 15 +++++++++++++--
 net/core/skbuff.c       |  6 ++++--
 2 files changed, 17 insertions(+), 4 deletions(-)

Comments

David Miller March 30, 2018, 4:49 p.m. UTC | #1 
From: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
Date: Thu, 29 Mar 2018 19:05:28 +0900

> Eric Dumazet reported syzbot found a new bug which leads to underflow of
> size argument of memmove(), causing crash[1]. This can be triggered by tun
> devices.
> 
> The underflow happened because skb_vlan_untag() did not expect vlan packets
> without ethernet headers, and tun can produce such packets.
> I also checked vlan_insert_inner_tag() and found a similar bug.
> 
> This series fixes these problems.
> 
> [1] https://marc.info/?l=linux-netdev&m=152221753920510&w=2

Series applied, thank you.