RE: [net-next 2/2] ifb: add device MTU validation check

-----Original Message-----
From: Stephen Hemminger [mailto:stephen@networkplumber.org]
Sent: 2017年9月21日 23:10
To: Zhang Shengju <redacted>
Cc: davem@davemloft.net; willemb@google.com; netdev@vger.kernel.org
Subject: Re: [net-next 2/2] ifb: add device MTU validation check

On Thu, 21 Sep 2017 21:32:02 +0800
Zhang Shengju [off-list ref] wrote:

quoted

Currently, any mtu value can be assigned when adding a new ifb device:
[~]# ip link add name ifb2 mtu 100000 type ifb [~]# ip link show ifb2
18: ifb2: <BROADCAST,NOARP> mtu 100000 qdisc noop state DOWN mode

DEFAULT group default qlen 32

quoted

    link/ether 7a:bf:f4:63:da:d1 brd ff:ff:ff:ff:ff:ff

This patch adds device MTU validation check.

Signed-off-by: Zhang Shengju <redacted>
---
 drivers/net/ifb.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/net/ifb.c b/drivers/net/ifb.c index

8870bd2..ce84ad2 100644

--- a/drivers/net/ifb.c
+++ b/drivers/net/ifb.c

@@ -282,6 +282,14 @@ static int ifb_validate(struct nlattr *tb[], struct

nlattr *data[],

quoted

 		if (!is_valid_ether_addr(nla_data(tb[IFLA_ADDRESS])))
 			return -EADDRNOTAVAIL;
 	}
+
+	if (tb[IFLA_MTU]) {
+		u32 mtu = nla_get_u32(tb[IFLA_MTU]);
+
+		if (mtu < ETH_MIN_MTU || mtu > ETH_DATA_LEN)
+			return -EINVAL;
+	}
+
 	return 0;
 }

What about running ifb with packets coming from devices with jumbo frames?
Also since ifb is an input only device, MTU doesn't matter.

Actually ifb_setup() function setup ifb valid MTU range: [68, 1500], and
this will be check at dev_set_mtu() function. 
You can't setup mtu out of this range after creation, but you can set any
value when adding new ifb device.
This is inconsistent, and I think we should add this check at creation time 

BRs,
ZSJ