From: Jiri Benc <jb...@redhat.com> Date: Thu, 21 Aug 2014 21:33:44 +0200
> When there are multiple vlan headers present in a received frame, the first > one is put into vlan_tci and protocol is set to ETH_P_8021Q. Anything in the > skb beyond the VLAN TPID may be still non-linear, including the inner TCI > and ethertype. While ovs_flow_extract takes care of IP and IPv6 headers, it > does nothing with ETH_P_8021Q. Later, if OVS_ACTION_ATTR_POP_VLAN is > executed, __pop_vlan_tci pulls the next vlan header into vlan_tci. > > This leads to two things: > > 1. Part of the resulting ethernet header is in the non-linear part of the > skb. When eth_type_trans is called later as the result of > OVS_ACTION_ATTR_OUTPUT, kernel BUGs in __skb_pull. Also, __pop_vlan_tci > is in fact accessing random data when it reads past the TPID. > > 2. network_header points into the ethernet header instead of behind it. > mac_len is set to a wrong value (10), too. > > Reported-by: Yulong Pei <y...@redhat.com> > Signed-off-by: Jiri Benc <jb...@redhat.com> Applied and queued up for -stable, thanks Jiri. _______________________________________________ dev mailing list dev@openvswitch.org http://openvswitch.org/mailman/listinfo/dev
