netdev - Re: tun: mark small packets as owned by the tap sock

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 13 Aug 2019 16:33:59 +0800
From:   Jason Wang <jasowang@...hat.com>
To:     Dave Jones <davej@...emonkey.org.uk>,
        Alexis Bauvin <abauvin@...leway.com>
Cc:     netdev@...r.kernel.org
Subject: Re: tun: mark small packets as owned by the tap sock


On 2019/8/13 上午6:19, Dave Jones wrote:
> On Wed, Aug 07, 2019 at 12:30:07AM +0000, Linux Kernel wrote:
>   > Commit:     4b663366246be1d1d4b1b8b01245b2e88ad9e706
>   > Parent:     16b2084a8afa1432d14ba72b7c97d7908e178178
>   > Web:        https://git.kernel.org/torvalds/c/4b663366246be1d1d4b1b8b01245b2e88ad9e706
>   > Author:     Alexis Bauvin <abauvin@...leway.com>
>   > AuthorDate: Tue Jul 23 16:23:01 2019 +0200
>   >
>   >     tun: mark small packets as owned by the tap sock
>   >
>   >     - v1 -> v2: Move skb_set_owner_w to __tun_build_skb to reduce patch size
>   >
>   >     Small packets going out of a tap device go through an optimized code
>   >     path that uses build_skb() rather than sock_alloc_send_pskb(). The
>   >     latter calls skb_set_owner_w(), but the small packet code path does not.
>   >
>   >     The net effect is that small packets are not owned by the userland
>   >     application's socket (e.g. QEMU), while large packets are.
>   >     This can be seen with a TCP session, where packets are not owned when
>   >     the window size is small enough (around PAGE_SIZE), while they are once
>   >     the window grows (note that this requires the host to support virtio
>   >     tso for the guest to offload segmentation).
>   >     All this leads to inconsistent behaviour in the kernel, especially on
>   >     netfilter modules that uses sk->socket (e.g. xt_owner).
>   >
>   >     Fixes: 66ccbc9c87c2 ("tap: use build_skb() for small packet")
>   >     Signed-off-by: Alexis Bauvin <abauvin@...leway.com>
>   >     Acked-by: Jason Wang <jasowang@...hat.com>
>
> This commit breaks ipv6 routing when I deployed on it a linode.
> It seems to work briefly after boot, and then silently all packets get
> dropped. (Presumably, it's dropping RA or ND packets)
>
> With this reverted, everything works as it did in rc3.
>
> 	Dave


Hi:

Two questions:

- Are you using XDP for TUN?

- Does it work before 66ccbc9c87c2? If yes, could you show us the result 
of net_dropmonitor?

Thanks


>