kernel/git/stable/linux.git/drivers/net/vxlan.c, branch linux-4.13.y

vxlan: fix the issue that neigh proxy blocks all icmpv6 packets

2017-11-24T07:35:57+00:00

[ Upstream commit 8bff3685a4bbf175a96bc6a528f13455d8d38244 ] Commit f1fb08f6337c ("vxlan: fix ND proxy when skb doesn't have transport header offset") removed icmp6_code and icmp6_type check before calling neigh_reduce when doing neigh proxy. It means all icmpv6 packets would be blocked by this, not only ns packet. In Jianlin's env, even ping6 couldn't work through it. This patch is to bring the icmp6_code and icmp6_type check back and also removed the same check from neigh_reduce(). Fixes: f1fb08f6337c ("vxlan: fix ND proxy when skb doesn't have transport header offset") Reported-by: Jianlin Shi Signed-off-by: Xin Long Reviewed-by: Vincent Bernat Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman

vxlan: fix remcsum when GRO on and CHECKSUM_PARTIAL boundary is outer UDP

2017-08-01T23:09:14+00:00

In the case that GRO is turned on and the original received packet is CHECKSUM_PARTIAL, if the outer UDP header is exactly at the last csum-unnecessary point, which for instance could occur if the packet comes from another Linux guest on the same Linux host, we have to do either remcsum_adjust or set up CHECKSUM_PARTIAL again with its csum_start properly reset considering RCO. However, since b7fe10e5ebac("gro: Fix remcsum offload to deal with frags in GRO") that barrier in such case could be skipped if GRO turned on, hence we pass over it and the inner L4 validation mistakenly reckons it as a bad csum. This patch makes remcsum_offload being reset at the same time of GRO remcsum cleanup, so as to make it work in such case as before. Fixes: b7fe10e5ebac ("gro: Fix remcsum offload to deal with frags in GRO") Signed-off-by: Koichiro Den Signed-off-by: David S. Miller

net, vxlan: convert vxlan_sock.refcnt from atomic_t to refcount_t

2017-07-04T21:35:15+00:00

refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova Signed-off-by: Hans Liljestrand Signed-off-by: Kees Cook Signed-off-by: David Windsor Signed-off-by: David S. Miller

vxlan: fix hlist corruption

2017-07-03T09:36:27+00:00

It's not a good idea to add the same hlist_node to two different hash lists. This leads to various hard to debug memory corruptions. Fixes: b1be00a6c39f ("vxlan: support both IPv4 and IPv6 sockets in a single vxlan device") Signed-off-by: Jiri Benc Signed-off-by: David S. Miller

vxlan: correctly set vxlan->net when creating the device in a netns

2017-07-03T09:04:10+00:00

Commit a985343ba906 ("vxlan: refactor verification and application of configuration") modified vxlan device creation, and replaced the assignment of vxlan->net to src_net with dev_net(netdev) in ->setup(). But dev_net(netdev) is not the same as src_net. At the time ->setup() is called, dev_net hasn't been set yet, so we end up creating the socket for the vxlan device in init_net. Fix this by bringing back the assignment of vxlan->net during device creation. Fixes: a985343ba906 ("vxlan: refactor verification and application of configuration") Signed-off-by: Sabrina Dubroca Reviewed-by: Matthias Schiffer Signed-off-by: David S. Miller

vxlan: fix incorrect nlattr access in MTU check

2017-06-27T18:40:35+00:00

The access to the wrong variable could lead to a NULL dereference and possibly other invalid memory reads in vxlan newlink/changelink requests with a IFLA_MTU attribute. Fixes: a985343ba906 "vxlan: refactor verification and application of configuration" Signed-off-by: Matthias Schiffer Signed-off-by: David S. Miller

net: add netlink_ext_ack argument to rtnl_link_ops.validate

2017-06-27T03:13:22+00:00

Add support for extended error reporting. Signed-off-by: Matthias Schiffer Acked-by: David Ahern Signed-off-by: David S. Miller

net: add netlink_ext_ack argument to rtnl_link_ops.changelink

2017-06-27T03:13:22+00:00

Add support for extended error reporting. Signed-off-by: Matthias Schiffer Acked-by: David Ahern Signed-off-by: David S. Miller

net: add netlink_ext_ack argument to rtnl_link_ops.newlink

2017-06-27T03:13:21+00:00

Add support for extended error reporting. Signed-off-by: Matthias Schiffer Acked-by: David Ahern Signed-off-by: David S. Miller

vxlan: allow multiple VXLANs with same VNI for IPv6 link-local addresses

2017-06-20T17:37:03+00:00

As link-local addresses are only valid for a single interface, we can allow to use the same VNI for multiple independent VXLANs, as long as the used interfaces are distinct. This way, VXLANs can always be used as a drop-in replacement for VLANs with greater ID space. This also extends VNI lookup to respect the ifindex when link-local IPv6 addresses are used, so using the same VNI on multiple interfaces can actually work. Signed-off-by: Matthias Schiffer Signed-off-by: David S. Miller