netdev - Re: [PATCH net] ipv4: only create late gso-skb if skb is already set up with CHECKSUM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 25 Feb 2016 19:07:06 -0500
From:	Wakko Warner <wakko@...mx.eu.org>
To:	Hannes Frederic Sowa <hannes@...essinduktion.org>
Cc:	netdev@...r.kernel.org, Jiri Benc <jbenc@...hat.com>
Subject: Re: [PATCH net] ipv4: only create late gso-skb if skb is already set
 up with CHECKSUM_PARTIAL

Hannes Frederic Sowa wrote:
> Otherwise we break the contract with GSO to only pass CHECKSUM_PARTIAL
> skbs down. This can easily happen with UDP+IPv4 sockets with the first
> MSG_MORE write smaller than the MTU, second write is a sendfile.
> 
> Returning -EOPNOTSUPP lets the callers fall back into normal sendmsg path,
> were we calculate the checksum manually during copying.
> 
> Commit d749c9cbffd6 ("ipv4: no CHECKSUM_PARTIAL on MSG_MORE corked
> sockets") started to exposes this bug.
> 
> Fixes: d749c9cbffd6 ("ipv4: no CHECKSUM_PARTIAL on MSG_MORE corked sockets")
> Reported-by: Jiri Benc <jbenc@...hat.com>
> Cc: Jiri Benc <jbenc@...hat.com>
> Reported-by: Wakko Warner <wakko@...mx.eu.org>
> Cc: Wakko Warner <wakko@...mx.eu.org>
> Signed-off-by: Hannes Frederic Sowa <hannes@...essinduktion.org>

I just tested this with 2 of my VMs.  It appears to have fixed the issue.

> ---
>  net/ipv4/ip_output.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
> index 64878efa045c13..565bf64b2b7d60 100644
> --- a/net/ipv4/ip_output.c
> +++ b/net/ipv4/ip_output.c
> @@ -1236,13 +1236,16 @@ ssize_t	ip_append_page(struct sock *sk, struct flowi4 *fl4, struct page *page,
>  	if (!skb)
>  		return -EINVAL;
>  
> -	cork->length += size;
>  	if ((size + skb->len > mtu) &&
>  	    (sk->sk_protocol == IPPROTO_UDP) &&
>  	    (rt->dst.dev->features & NETIF_F_UFO)) {
> +		if (skb->ip_summed != CHECKSUM_PARTIAL)
> +			return -EOPNOTSUPP;
> +
>  		skb_shinfo(skb)->gso_size = mtu - fragheaderlen;
>  		skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
>  	}
> +	cork->length += size;
>  
>  	while (size > 0) {
>  		if (skb_is_gso(skb)) {
> -- 
> 2.5.0
> 
-- 
 Microsoft has beaten Volkswagen's world record.  Volkswagen only created 22
 million bugs.