netdev - Re: [PATCH net-next 0/2] net: Fix "hw csum failure" message flood for ppp tunnel

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20150420.220144.784138484983756987.davem@davemloft.net>
Date:	Mon, 20 Apr 2015 22:01:44 -0400 (EDT)
From:	David Miller <davem@...emloft.net>
To:	tom@...bertland.com
Cc:	netdev@...r.kernel.org
Subject: Re: [PATCH net-next 0/2] net: Fix "hw csum failure" message flood
 for ppp tunnel

From: Tom Herbert <tom@...bertland.com>
Date: Mon, 20 Apr 2015 14:10:03 -0700

> This patch set addresses bug "Bug 95171 - "hw csum failure" message
> flood for ppp tunnel since upgrade to 3.16". The problem is that pppoe
> is being used over UDP with UDP checksusm enabled. On receive
> checksum conversion turns checksum-unnecessary in checksum-
> complete. The PPP receive functions do no properly pull
> the checksum over its headers, so that when an encapsulated
> checksums is considered the checksum-complete value is incorrect.
> 
> This patch adds skb_checksum_complete_unset which can be called
> in the receive path in lieu of pulling checksum complete in
> layer. This is useful when the packet is being modified (e.g.
> decompressed) and the checksum-complete value is no longer
> relevant.
> 
> In the ppp_receive_frame we call skb_checksum_complete_unset to toss
> out checksum-complete. This should eliminate the reported messages.
> Alternatively, we could add skb_postpull_rcsum and probably
> special case handling for VJ compression if maintaining the
> checksum-complete is needed (not clear to me this is worth the
> effort).
> 
> I haven't tested this since setting up the failure scenario doesn't
> seem trivial to configure.

I'm preemptively applying this, but it's really important for
folks to give this some good testing.

Thanks Tom.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html