Re: net: GPF in eth_header
From: Florian Westphal <fw@strlen.de>
Date: 2016-11-28 21:37:54
Also in:
lkml
Eric Dumazet [off-list ref] wrote:
quoted
Might be a bug added in commit daaa7d647f81f3 ("netfilter: ipv6: avoid nf_iterate recursion") Florian, what do you think of dropping a packet that presumably was mangled badly by nf_ct_frag6_queue() ?
ipv4 definitely frees malformed packets. In general, I think netfilter should avoid 'silent' drops if possible and let skb continue, but of course such skbs should not be made worse as what we ate to begin with...
quoted
(Like about 48 byte pulled :(, and/or skb->csum changed )
I think this warrants a review of ipv6 reassembly too, bug reported here is because ipv6 nf defrag is also done on output.
quoted hunk ↗ jump to hunk
diff --git a/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c b/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c index f7aab5ab93a5..508739a3ca2a 100644 --- a/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c +++ b/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c@@ -65,9 +65,9 @@ static unsigned int ipv6_defrag(void *priv, err = nf_ct_frag6_gather(state->net, skb, nf_ct6_defrag_user(state->hook, skb)); - /* queued */ - if (err == -EINPROGRESS) - return NF_STOLEN; + /* queued or mangled ... */ + if (err) + return (err == -EINPROGRESS) ? NF_STOLEN : NF_DROP; return NF_ACCEPT;
Looks good, we'll need to change some of the errno return codes in nf_ct_frag6_gather to 0 though for this to work, which should not be too hard ;)