netdev - Re: [PATCH net-next] net: mhi-net: Add de-aggeration support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 29 Jan 2021 21:12:03 -0500
From:   Willem de Bruijn <willemdebruijn.kernel@...il.com>
To:     Jakub Kicinski <kuba@...nel.org>
Cc:     Loic Poulain <loic.poulain@...aro.org>,
        David Miller <davem@...emloft.net>,
        Network Development <netdev@...r.kernel.org>
Subject: Re: [PATCH net-next] net: mhi-net: Add de-aggeration support

On Fri, Jan 29, 2021 at 8:01 PM Jakub Kicinski <kuba@...nel.org> wrote:
>
> On Mon, 25 Jan 2021 16:45:57 +0100 Loic Poulain wrote:
> > When device side MTU is larger than host side MRU, the packets
> > (typically rmnet packets) are split over multiple MHI transfers.
> > In that case, fragments must be re-aggregated to recover the packet
> > before forwarding to upper layer.
> >
> > A fragmented packet result in -EOVERFLOW MHI transaction status for
> > each of its fragments, except the final one. Such transfer was
> > previoulsy considered as error and fragments were simply dropped.
> >
> > This patch implements the aggregation mechanism allowing to recover
> > the initial packet. It also prints a warning (once) since this behavior
> > usually comes from a misconfiguration of the device (modem).
> >
> > Signed-off-by: Loic Poulain <loic.poulain@...aro.org>
>
> > +static struct sk_buff *mhi_net_skb_append(struct mhi_device *mhi_dev,
> > +                                       struct sk_buff *skb1,
> > +                                       struct sk_buff *skb2)
> > +{
> > +     struct sk_buff *new_skb;
> > +
> > +     /* This is the first fragment */
> > +     if (!skb1)
> > +             return skb2;
> > +
> > +     /* Expand packet */
> > +     new_skb = skb_copy_expand(skb1, 0, skb2->len, GFP_ATOMIC);
> > +     dev_kfree_skb_any(skb1);
> > +     if (!new_skb)
> > +             return skb2;
>
> I don't get it, if you failed to grow the skb you'll return the next
> fragment to the caller? So the frame just lost all of its data up to
> where skb2 started? The entire fragment "train" should probably be
> dropped at this point.
>
> I think you can just hang the skbs off skb_shinfo(p)->frag_list.
>
> Willem - is it legal to feed frag_listed skbs into netif_rx()?

As far as I know. udp gro will generate frag_list packets through
dev_gro_receive. That and netif_rx share most downstream code. I don't
think anything between netif_rx and __netif_receive_skb_core cares
about the skb contents.