• Kirill Smelkov's avatar
    sky2: Fix crash on receiving VLAN frames · 88dccf5b
    Kirill Smelkov authored
    After recent 86a9bad3 (net: vlan: add protocol argument to packet
    tagging functions) my sky2 started to crash on receive of tagged
    frames, with backtrace similar to
    The problem turned out to be:
        1) sky2 copies small packets from ring on RX, and in its
           receive_copy() skb header is copied manually field, by field, and
           only for some fields;
        2) 86a9bad3  added skb->vlan_proto, which vlan_untag() or
           __vlan_hwaccel_put_tag() set, and which is later used in
           That patch updated copy_skb_header() for newly introduced
           skb->vlan_proto, but overlooked the need to also copy it in sky2's
    Because of 2, we have the following scenario:
        - frame is received and tagged in a ring, by sky2_rx_tag(). Both
          skb->vlan_proto and skb->vlan_tci are set;
        - later skb is decided to be copied, but skb->vlan_proto is
          forgotten and becomes 0.
        - in the beginning of vlan_do_receive() we call
            __be16 vlan_proto = skb->vlan_proto;
            vlan_dev = vlan_find_dev(skb->dev, vlan_proto, vlan_id);
          which eventually invokes
          and that routine BUGs for everything except ETH_P_8021Q and
    Fix it.
    Stephen, I wonder, why copy_skb_header() is not used in
    sky2.c::receive_copy() ? Problems, where receive_copy was updated field
    by field showed several times already, e.g.
        3f42941b    (sky2: propogate rx hash when packet is copied)
        (sky2: fix receive length error in mixed non-VLAN/VLAN traffic)
    Cc: Patrick McHardy <kaber@trash.net>
    Cc: Stephen Hemminger <stephen@networkplumber.org>
    Cc: Mirko Lindner <mlindner@marvell.com>
    Signed-off-by: default avatarKirill Smelkov <kirr@mns.spb.ru>
    Acked-by: default avatarStephen Hemminger <stephen@networkplumber.org>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
sky2.c 136 KB