hi Eric, thanks for looking at this! On Tue, 2019-05-28 at 14:02 -0700, Eric Dumazet wrote: > > On 5/28/19 1:50 PM, Davide Caratti wrote: > > + vlan = (struct vlan_hdr *)skb->data; > > + protocol = vlan->h_vlan_encapsulated_proto; > > + skb_pull(skb, VLAN_HLEN); > > + skb_reset_network_header(skb); > > + (*vlan_hdr_count)++; > > + } > > + goto again; > > What prevents this loop to access data not yet in skb->head ?
just luck. 'pedit' does skb_header_pointer() later on, when it writes in the packet. But indeed, there is no guarantee that all the nested vlan headers are in the linear area of the packet. Looking at 2ecba2d1e45b and current act_csum.c, probably also tcf_csum_act() needs the same check: I will try a patch for that tomorrow. > skb_header_pointer() (or pskb_may_pull()) seems needed. pskb_may_pull(), with proper error handling, seems better to me. regards, -- davide
