linux-kernel - Re: [PATCH net] net: fix segmentation after TCP/UDP fraglist GRO

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ba71e590-6751-49c1-85c9-97e5dc34ee3c@nbd.name>
Date: Tue, 15 Jul 2025 13:35:12 +0200
From: Felix Fietkau <nbd@....name>
To: Willem de Bruijn <willemdebruijn.kernel@...il.com>,
 netdev@...r.kernel.org, Eric Dumazet <edumazet@...gle.com>,
 Neal Cardwell <ncardwell@...gle.com>, Kuniyuki Iwashima <kuniyu@...gle.com>,
 "David S. Miller" <davem@...emloft.net>, David Ahern <dsahern@...nel.org>,
 Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
 Simon Horman <horms@...nel.org>, Willem de Bruijn <willemb@...gle.com>,
 Richard Gobert <richardbgobert@...il.com>
Cc: linux-kernel@...r.kernel.org
Subject: Re: [PATCH net] net: fix segmentation after TCP/UDP fraglist GRO

On 06.07.25 15:45, Willem de Bruijn wrote:
> Felix Fietkau wrote:
>> Since "net: gro: use cb instead of skb->network_header", the skb network
>> header is no longer set in the GRO path.
>> This breaks fraglist segmentation, which relies on ip_hdr()/tcp_hdr()
> 
> Only ip_hdr is in scope.
> 
> Reviewing TCP and UDP GSO, tcp_hdr/transport header is used also
> outside segment list. Non segment list GSO also uses ip_hdr in case
> pseudo checksum needs to be set.
> 
> The GSO code is called with skb->data at the relevant header, so L4
> helpers are not strictly needed. The main issue is that data will be
> at the L4 header, and some GSO code also needs to see the IP header
> (e.g., for aforementioned pseudo checksum calculation).

I just spent some time reviewing the code in order to understand how to 
fix it properly, and I still don't fully understand what you wrote 
above, especially the part related to "Non segment list GSO".

The issue that I'm trying to fix is that the skb network header is wrong 
for all skbs stored in the frag_list of the first skb.
The main skb is fine, since the offsets are handled by the network 
stack. For all the extra fragment skbs, the offsets are unset because we 
bypassed the part of the stack that sets them.

Since non-segment-list GSO skbs don't carry extra frag_list skbs, I 
don't see how they can share the same issue.

If I misread what you wrote, please point me at the relevant code 
context that I'm missing.

Thanks,

- Felix