lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Wed, 26 Oct 2016 12:47:22 +0200
From:   Daniel Borkmann <>
To:     Willem de Bruijn <>,
CC:, Willem de Bruijn <>
Subject: Re: [PATCH net] packet: on direct_xmit, limit tso and csum to supported

On 10/26/2016 02:28 AM, Willem de Bruijn wrote:
> From: Willem de Bruijn <>
> When transmitting on a packet socket with PACKET_VNET_HDR and
> PACKET_QDISC_BYPASS, validate device support for features requested
> in vnet_hdr.
> Drop TSO packets sent to devices that do not support TSO or have the
> feature disabled. Note that the latter currently do process those
> packets correctly, regardless of not advertising the feature.
> Because of SKB_GSO_DODGY, it is not sufficient to test device features
> with netif_needs_gso. Full validate_xmit_skb is needed.
> Switch to software checksum for non-TSO packets that request checksum
> offload if that device feature is unsupported or disabled. Note that
> similar to the TSO case, device drivers may perform checksum offload
> correctly even when not advertising it.
> When switching to software checksum, packets hit skb_checksum_help,
> which has two BUG_ON checksum not in linear segment. Packet sockets
> always allocate at least up to csum_start + csum_off + 2 as linear.

Ok, for the tpacket_fill_skb() case with SOCK_RAW, it's guaranteed,
because if we have a vnet header, then copylen would cover that here
(as opposed to just dev->hard_header_len). With Eric's suggestion,
looks good to me. Thanks, Willem!

Powered by blists - more mailing lists