netdev - Re: [PATCH] net: tun: fix tun_xdp_one() for IFF

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 22 Jun 2021 12:52:29 +0800
From:   Jason Wang <jasowang@...hat.com>
To:     David Woodhouse <dwmw2@...radead.org>,
        netdev <netdev@...r.kernel.org>
Cc:     Eugenio Pérez <eperezma@...hat.com>
Subject: Re: [PATCH] net: tun: fix tun_xdp_one() for IFF_TUN mode


在 2021/6/22 上午4:43, David Woodhouse 写道:
> On Mon, 2021-06-21 at 15:50 +0100, David Woodhouse wrote:
>> On Mon, 2021-06-21 at 11:52 +0100, David Woodhouse wrote:
>>> Firstly, I don't think I can set IFF_VNET_HDR on the tun device after
>>> opening it. So my model of "open the tun device, then *see* if we can
>>> use vhost to accelerate it" doesn't work.
>>>
>>> I tried setting VHOST_NET_F_VIRTIO_NET_HDR in the vhost features
>>> instead, but that gives me a weird failure mode where it drops around
>>> half the incoming packets, and I haven't yet worked out why.
>> FWIW that problem also goes away if I set TUNSNDBUF and avoid the XDP
>> data path.
> Looks like there are two problems there.
>
> Firstly, vhost_net_build_xdp() doesn't cope well with sock_hlen being
> zero. It reads those zero bytes into its buffer, then points 'gso' at
> the buffer with no valid data in it, and checks gso->flags for the
> NEEDS_CSUM flag.
>
> Secondly, tun_xdp_one() doesn't cope with receiving packets without the
> virtio header either. While tun_get_user() correctly checks
> IFF_VNET_HDR, tun_xdp_one() does not, and treats the start of my IP
> packets as if they were a virtio_net_hdr.
>
> I'll look at turning my code into a test case for kernel selftests.


I cook two patches. Please see and check if they fix the problem. 
(compile test only for me).

Thanks


>
>

View attachment "0001-vhost_net-validate-gso-metadata-only-if-socket-has-v.patch" of type "text/plain" (1004 bytes)

View attachment "0002-tun-use-vnet-header-only-when-IFF_VNET_HDR-in-tun_xd.patch" of type "text/plain" (1724 bytes)