netdev - [PATCH] Re: skb_segment() questions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20090401091801.GA5970@ff.dom.local>
Date:	Wed, 1 Apr 2009 09:18:01 +0000
From:	Jarek Poplawski <jarkao2@...il.com>
To:	Herbert Xu <herbert@...dor.apana.org.au>
Cc:	James Huang <jamesclhuang@...il.com>,
	"David S. Miller" <davem@...emloft.net>, netdev@...r.kernel.org
Subject: [PATCH] Re: skb_segment() questions

On 29-03-2009 03:07, Herbert Xu wrote:
> On Wed, Mar 04, 2009 at 07:12:40PM -0800, James Huang wrote:
>> (2) What is the purpose of the this check?
>>
>> `    if (pos >= offset + len)
>>         continue;
>>
>>      If the payload in the head buffer of skb has at least mss bytes, this
>> check will succeed and no payload in skbâ??s head buffer will be copy into
>> nskb
>> through a call to skb_copy_from_linear_data_offset(). Something seems to be
>> wrong here.
> 
> Indeed.  This breaks linear packets, which unfortunately older
> versions of tun likes to construct.
> 
> gso: Fix support for linear packets
> 
> When GRO/frag_list support was added to GSO, I made an error
> which broke the support for segmenting linear GSO packets (GSO
> packets are normally non-linear in the payload).
> 
> These days most of these packets are constructed by the tun
> driver, which prefers to allocate linear memory if possible.
> This is fixed in the latest kernel, but for 2.6.29 and earlier
> it is still the norm.
> 
> Therefore this bug causes failures with GSO when used with tun
> in 2.6.29.
> 
> Reported-by: James Huang <jamesclhuang@...il.com>
> Signed-off-by: Herbert Xu <herbert@...dor.apana.org.au>
> 
> diff --git a/net/core/skbuff.c b/net/core/skbuff.c
> index 6acbf9e..ce6356c 100644
> --- a/net/core/skbuff.c
> +++ b/net/core/skbuff.c
> @@ -2579,7 +2579,7 @@ struct sk_buff *skb_segment(struct sk_buff *skb, int features)
>  					  skb_network_header_len(skb));
>  		skb_copy_from_linear_data(skb, nskb->data, doffset);
>  
> -		if (pos >= offset + len)
> +		if (fskb != skb_shinfo(skb)->frag_list)
>  			continue;
>  
>  		if (!sg) {
> 

----------------------->
gso: Fix support for linear packets 2

The previous fix removed a check, which should be useful, only a bit
later, by skipping at least two similar checks and three useless
assignments in case a header is (still) copied.

Signed-off-by: Jarek Poplawski <jarkao2@...il.com>
---

 net/core/skbuff.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index ce6356c..2123a92 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2594,6 +2594,8 @@ struct sk_buff *skb_segment(struct sk_buff *skb, int features)
 
 		skb_copy_from_linear_data_offset(skb, offset,
 						 skb_put(nskb, hsize), hsize);
+		if (pos >= offset + len)
+			continue;
 
 		while (pos < offset + len && i < nfrags) {
 			*frag = skb_shinfo(skb)->frags[i];
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html