netdev - Re: [PATCH net v2] skbuff: Release nfct refcount on napi stolen or re-used skbs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 5 Jul 2021 13:32:53 +0300
From:   Paul Blakey <paulb@...dia.com>
To:     Mika Penttilä <mika.penttila@...tfour.com>
CC:     <netdev@...r.kernel.org>, Eric Dumazet <eric.dumazet@...il.com>,
        "David S. Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>,
        "Alexei Starovoitov" <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        "John Fastabend" <john.fastabend@...il.com>,
        Saeed Mahameed <saeedm@...dia.com>,
        "Oz Shlomo" <ozsh@...dia.com>, Roi Dayan <roid@...dia.com>,
        Vlad Buslov <vladbu@...dia.com>
Subject: Re: [PATCH net v2] skbuff: Release nfct refcount on napi stolen or
 re-used skbs



On Mon, 5 Jul 2021, Mika Penttilä wrote:

> Hi!
> 
> On 5.7.2021 10.49, Paul Blakey wrote:
> > When multiple SKBs are merged to a new skb under napi GRO,
> > or SKB is re-used by napi, if nfct was set for them in the
> > driver, it will not be released while freeing their stolen
> > head state or on re-use.
> >
> > Release nfct on napi's stolen or re-used SKBs, and
> > in gro_list_prepare, check conntrack metadata diff.
> >
> > Fixes: 5c6b94604744 ("net/mlx5e: CT: Handle misses after executing CT
> > action")
> > Reviewed-by: Roi Dayan <roid@...dia.com>
> > Signed-off-by: Paul Blakey <paulb@...dia.com>
> > ---
> > Changelog:
> >  v1->v2:
> >   Check for different flows based on CT and chain metadata in
> >   gro_list_prepare
> >
> >   net/core/dev.c    | 13 +++++++++++++
> >   net/core/skbuff.c |  1 +
> >   2 files changed, 14 insertions(+)
> >
> > diff --git a/net/core/dev.c b/net/core/dev.c
> > index 439faadab0c2..bf62cb2ec6da 100644
> > --- a/net/core/dev.c
> > +++ b/net/core/dev.c
> > @@ -5981,6 +5981,18 @@ static void gro_list_prepare(const struct list_head
> > *head,
> >      diffs = memcmp(skb_mac_header(p),
> >              skb_mac_header(skb),
> >              maclen);
> > +
> > +		diffs |= skb_get_nfct(p) ^ skb_get_nfct(skb);
> > +
> > +		if (!diffs) {
> > +			struct tc_skb_ext *skb_ext = skb_ext_find(skb,
> > TC_SKB_EXT);
> > +			struct tc_skb_ext *p_ext = skb_ext_find(p,
> > TC_SKB_EXT);
> > +
> > +			diffs |= (!!p_ext) ^ (!!skb_ext);
> > +			if (!diffs && unlikely(skb_ext))
> > +				diffs |= p_ext->chain ^ skb_ext->chain;
> > +		}
> > +
> >    	NAPI_GRO_CB(p)->same_flow = !diffs;
> >   	}
> >   }
> > @@ -6243,6 +6255,7 @@ static void napi_reuse_skb(struct napi_struct *napi,
> > struct sk_buff *skb)
> >    skb_shinfo(skb)->gso_type = 0;
> >    skb->truesize = SKB_TRUESIZE(skb_end_offset(skb));
> >    skb_ext_reset(skb);
> > +	nf_reset_ct(skb);
> >   
> >   	napi->skb = skb;
> >   }
> > diff --git a/net/core/skbuff.c b/net/core/skbuff.c
> > index bbc3b4b62032..239eb2fba255 100644
> > --- a/net/core/skbuff.c
> > +++ b/net/core/skbuff.c
> > @@ -939,6 +939,7 @@ void __kfree_skb_defer(struct sk_buff *skb)
> >   
> >   void napi_skb_free_stolen_head(struct sk_buff *skb)
> >   {
> > +	nf_conntrack_put(skb_nfct(skb));
> 
> Should this be  nf_reset_ct() to clear the skb->_nfct and not leave a
> uncounted reference?

Yes it should, thanks! Sending revision.

> 
> >    skb_dst_drop(skb);
> >    skb_ext_put(skb);
> >    napi_skb_cache_put(skb);
> 
>