netdev - Re: [ PATCH v1 2/2] ibmveth: Identify ingress large send packets.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 10 Oct 2020 12:51:30 -0400
From:   Willem de Bruijn <willemdebruijn.kernel@...il.com>
To:     David Wilder <dwilder@...ibm.com>
Cc:     Network Development <netdev@...r.kernel.org>,
        tlfalcon@...ux.ibm.com, cris.forno@....com,
        pradeeps@...ux.vnet.ibm.com, wilder@...ibm.com
Subject: Re: [ PATCH v1 2/2] ibmveth: Identify ingress large send packets.

On Sat, Oct 10, 2020 at 12:40 PM Willem de Bruijn
<willemdebruijn.kernel@...il.com> wrote:
>
> On Thu, Oct 8, 2020 at 3:06 PM David Wilder <dwilder@...ibm.com> wrote:
> >
> > Ingress large send packets are identified by either:
> > The IBMVETH_RXQ_LRG_PKT flag in the receive buffer
> > or with a -1 placed in the ip header checksum.
> > The method used depends on firmware version.
> >
> > Signed-off-by: David Wilder <dwilder@...ibm.com>
> > Reviewed-by: Thomas Falcon <tlfalcon@...ux.ibm.com>
> > Reviewed-by: Cristobal Forno <cris.forno@....com>
> > Reviewed-by: Pradeep Satyanarayana <pradeeps@...ux.vnet.ibm.com>
> > ---
> >  drivers/net/ethernet/ibm/ibmveth.c | 13 ++++++++++++-
> >  1 file changed, 12 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
> > index 3935a7e..e357cbe 100644
> > --- a/drivers/net/ethernet/ibm/ibmveth.c
> > +++ b/drivers/net/ethernet/ibm/ibmveth.c
> > @@ -1349,6 +1349,7 @@ static int ibmveth_poll(struct napi_struct *napi, int budget)
> >                         int offset = ibmveth_rxq_frame_offset(adapter);
> >                         int csum_good = ibmveth_rxq_csum_good(adapter);
> >                         int lrg_pkt = ibmveth_rxq_large_packet(adapter);
> > +                       __sum16 iph_check = 0;
> >
> >                         skb = ibmveth_rxq_get_buffer(adapter);
> >
> > @@ -1385,7 +1386,17 @@ static int ibmveth_poll(struct napi_struct *napi, int budget)
> >                         skb_put(skb, length);
> >                         skb->protocol = eth_type_trans(skb, netdev);
> >
> > -                       if (length > netdev->mtu + ETH_HLEN) {
> > +                       /* PHYP without PLSO support places a -1 in the ip
> > +                        * checksum for large send frames.
> > +                        */
> > +                       if (be16_to_cpu(skb->protocol) == ETH_P_IP) {
> > +                               struct iphdr *iph = (struct iphdr *)skb->data;
> > +
> > +                               iph_check = iph->check;
>
> Check against truncated/bad packets.

.. unless I missed context. Other code in this driver seems to peek in
the network and transport layer headers without additional geometry
and integrity checks, too.