On Thu, Oct 8, 2020 at 3:04 PM Willem de Bruijn <willemdebruijn.ker...@gmail.com> wrote: > > On Thu, Oct 8, 2020 at 1:34 PM Cong Wang <xiyou.wangc...@gmail.com> wrote: > > > > On Thu, Oct 8, 2020 at 4:49 AM Willem de Bruijn > > <willemdebruijn.ker...@gmail.com> wrote: > > > > > > On Wed, Oct 7, 2020 at 9:22 PM Cong Wang <xiyou.wangc...@gmail.com> wrote: > > > > > > > > GRE tunnel has its own header_ops, ipgre_header_ops, and sets it > > > > conditionally. When it is set, it assumes the outer IP header is > > > > already created before ipgre_xmit(). > > > > > > > > This is not true when we send packets through a raw packet socket, > > > > where L2 headers are supposed to be constructed by user. Packet > > > > socket calls dev_validate_header() to validate the header. But > > > > GRE tunnel does not set dev->hard_header_len, so that check can > > > > be simply bypassed, therefore uninit memory could be passed down > > > > to ipgre_xmit(). > > > > > > If dev->hard_header_len is zero, the packet socket will not reserve > > > room for the link layer header, so skb->data points to network_header. > > > But I don't see any uninitialized packet data? > > > > The uninit data is allocated by packet_alloc_skb(), if dev->hard_header_len > > is 0 and 'len' is anything between [0, tunnel->hlen + sizeof(struct iphdr)), > > dev_validate_header() still returns true obviously but only 'len' > > bytes are copied > > from user-space by skb_copy_datagram_from_iter(). Therefore, those bytes > > within range (len, tunnel->hlen + sizeof(struct iphdr)] are uninitialized.
Oh, do you mean that ipgre_xmit will process undefined data because it calls skb_pull(skb, tunnel->hlen + sizeof(struct iphdr)) ?
