linux-kernel - RE: [EXTERNAL] [PATCH net-next] net: add missing check for TCP fraglist GRO

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <663a15b153de_726ea29475@willemb.c.googlers.com.notmuch>
Date: Tue, 07 May 2024 07:51:13 -0400
From: Willem de Bruijn <willemdebruijn.kernel@...il.com>
To: Suman Ghosh <sumang@...vell.com>, 
 Felix Fietkau <nbd@....name>, 
 "netdev@...r.kernel.org" <netdev@...r.kernel.org>, 
 Eric Dumazet <edumazet@...gle.com>, 
 "David S. Miller" <davem@...emloft.net>, 
 David Ahern <dsahern@...nel.org>, 
 Jakub Kicinski <kuba@...nel.org>, 
 Paolo Abeni <pabeni@...hat.com>, 
 Willem de Bruijn <willemb@...gle.com>
Cc: "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: RE: [EXTERNAL] [PATCH net-next] net: add missing check for TCP
 fraglist GRO

Suman Ghosh wrote:
> >----------------------------------------------------------------------
> >It turns out that the existing checks do not guarantee that the skb can be
> >pulled up to the GRO offset. When using the usb r8152 network driver with
> >GRO fraglist, the BUG() in __skb_pull is often triggered.
> >Fix the crash by adding the missing check.
> >
> >Fixes: 8d95dc474f85 ("net: add code for TCP fraglist GRO")

> [Suman] Since this is a fix, this should be pushed to "net".

The referenced patch has only landed in net-next yet.

> >Signed-off-by: Felix Fietkau <nbd@....name>

Reviewed-by: Willem de Bruijn <willemb@...gle.com>

> >---
> > net/ipv4/tcp_offload.c | 1 +
> > 1 file changed, 1 insertion(+)
> >
> >diff --git a/net/ipv4/tcp_offload.c b/net/ipv4/tcp_offload.c index
> >c90704befd7b..a71d2e623f0c 100644
> >--- a/net/ipv4/tcp_offload.c
> >+++ b/net/ipv4/tcp_offload.c
> >@@ -353,6 +353,7 @@ struct sk_buff *tcp_gro_receive(struct list_head *head,
> >struct sk_buff *skb,
> > 		flush |= (__force int)(flags ^ tcp_flag_word(th2));
> > 		flush |= skb->ip_summed != p->ip_summed;
> > 		flush |= skb->csum_level != p->csum_level;
> >+		flush |= !pskb_may_pull(skb, skb_gro_offset(skb));
> > 		flush |= NAPI_GRO_CB(p)->count >= 64;

The same check already exists in udp_gro_receive, which has for longer
been calling skb_gro_receive_list:

       if (!pskb_may_pull(skb, skb_gro_offset(skb))) {
               NAPI_GRO_CB(skb)->flush = 1;
               return NULL;
       }

Alternatively it would make sense to deduplicate the check and move it
to skb_gro_receive_list itself, before

        skb_pull(skb, skb_gro_offset(skb));