| Message ID | 20240513133830.26285-1-faecknitz@hotsplots.de (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] net: mhi: set skb mac header before entering RX path | expand |
On Mon, 13 May 2024 15:38:30 +0200 Martin Fäcknitz wrote: > skb->mac_header must be set before passing the skb to the network stack, > because skb->mac_len is calculated from skb->mac_header in > __netif_receive_skb_core. > > Some network stack components, like xfrm, are using skb->mac_len to > check for an existing MAC header, which doesn't exist in this case. This > leads to memory corruption. Could you add a Fixes tag identifying the commit where the buggy code was added? And please make sure to CC the relevant maintainers (I mean the maintainers of the MHI code, specifically) on v2.
diff --git a/drivers/net/mhi_net.c b/drivers/net/mhi_net.c index ae169929a9d8..e432efddcb22 100644 --- a/drivers/net/mhi_net.c +++ b/drivers/net/mhi_net.c @@ -221,6 +221,8 @@ static void mhi_net_dl_callback(struct mhi_device *mhi_dev, break; } + skb_reset_mac_header(skb); + u64_stats_update_begin(&mhi_netdev->stats.rx_syncp); u64_stats_inc(&mhi_netdev->stats.rx_packets); u64_stats_add(&mhi_netdev->stats.rx_bytes, skb->len);
skb->mac_header must be set before passing the skb to the network stack, because skb->mac_len is calculated from skb->mac_header in __netif_receive_skb_core. Some network stack components, like xfrm, are using skb->mac_len to check for an existing MAC header, which doesn't exist in this case. This leads to memory corruption. Signed-off-by: Martin Fäcknitz <faecknitz@hotsplots.de> --- drivers/net/mhi_net.c | 2 ++ 1 file changed, 2 insertions(+)