netdev - Re: [PATCH] net: tun: fix tun_xdp_one() for IFF

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 21 Jun 2021 21:43:59 +0100
From:   David Woodhouse <dwmw2@...radead.org>
To:     Jason Wang <jasowang@...hat.com>, netdev <netdev@...r.kernel.org>
Cc:     Eugenio Pérez <eperezma@...hat.com>
Subject: Re: [PATCH] net: tun: fix tun_xdp_one() for IFF_TUN mode

On Mon, 2021-06-21 at 15:50 +0100, David Woodhouse wrote:
> On Mon, 2021-06-21 at 11:52 +0100, David Woodhouse wrote:
> > 
> > Firstly, I don't think I can set IFF_VNET_HDR on the tun device after
> > opening it. So my model of "open the tun device, then *see* if we can
> > use vhost to accelerate it" doesn't work.
> > 
> > I tried setting VHOST_NET_F_VIRTIO_NET_HDR in the vhost features
> > instead, but that gives me a weird failure mode where it drops around
> > half the incoming packets, and I haven't yet worked out why.
> 
> FWIW that problem also goes away if I set TUNSNDBUF and avoid the XDP
> data path.

Looks like there are two problems there.

Firstly, vhost_net_build_xdp() doesn't cope well with sock_hlen being
zero. It reads those zero bytes into its buffer, then points 'gso' at
the buffer with no valid data in it, and checks gso->flags for the
NEEDS_CSUM flag.

Secondly, tun_xdp_one() doesn't cope with receiving packets without the
virtio header either. While tun_get_user() correctly checks
IFF_VNET_HDR, tun_xdp_one() does not, and treats the start of my IP
packets as if they were a virtio_net_hdr.

I'll look at turning my code into a test case for kernel selftests.

Download attachment "smime.p7s" of type "application/x-pkcs7-signature" (5174 bytes)