From: wenxu <wenxu@ucloud.cn>

Date: Wed, 25 Nov 2020 12:01:22 +0800

Subject: net/sched: act_mirred: refactor the handle of xmit

Patch-mainline: v5.11-rc1

Git-commit: fa6d639930ee5cd3f932cc314f3407f07a06582d

References: CVE-2022-4269 bsc#1206024

This one is prepare for the next patch.

Signed-off-by: wenxu <wenxu@ucloud.cn>

Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Acked-by: Michal Kubecek <mkubecek@suse.cz>

---

 include/net/sch_generic.h |  5 -----

 net/sched/act_mirred.c    | 21 +++++++++++++++------

 2 files changed, 15 insertions(+), 11 deletions(-)

--- a/include/net/sch_generic.h

+++ b/include/net/sch_generic.h

@@ -1296,9 +1296,4 @@ void mini_qdisc_pair_swap(struct mini_Qdisc_pair *miniqp,

 void mini_qdisc_pair_init(struct mini_Qdisc_pair *miniqp, struct Qdisc *qdisc,

 			  struct mini_Qdisc __rcu **p_miniq);

-static inline int skb_tc_reinsert(struct sk_buff *skb, struct tcf_result *res)

-{

-	return res->ingress ? netif_receive_skb(skb) : dev_queue_xmit(skb);

-}

-

 #endif

--- a/net/sched/act_mirred.c

+++ b/net/sched/act_mirred.c

@@ -207,6 +207,18 @@ static int tcf_mirred_init(struct net *net, struct nlattr *nla,

 	return err;

 }

+static int tcf_mirred_forward(bool want_ingress, struct sk_buff *skb)

+{

+	int err;

+

+	if (!want_ingress)

+		err = dev_queue_xmit(skb);

+	else

+		err = netif_receive_skb(skb);

+

+	return err;

+}

+

 static int tcf_mirred_act(struct sk_buff *skb, const struct tc_action *a,

 			  struct tcf_result *res)

 {

@@ -291,18 +303,15 @@ static int tcf_mirred_act(struct sk_buff *skb, const struct tc_action *a,

 		/* let's the caller reinsert the packet, if possible */

 		if (use_reinsert) {

 			res->ingress = want_ingress;

-			if (skb_tc_reinsert(skb, res))

+			err = tcf_mirred_forward(res->ingress, skb);

+			if (err)

 				tcf_action_inc_overlimit_qstats(&m->common);

 			__this_cpu_dec(mirred_rec_level);

 			return TC_ACT_CONSUMED;

 		}

 	}

-	if (!want_ingress)

-		err = dev_queue_xmit(skb2);

-	else

-		err = netif_receive_skb(skb2);

-

+	err = tcf_mirred_forward(want_ingress, skb2);

 	if (err) {

 out:

 		tcf_action_inc_overlimit_qstats(&m->common);