netdev - Re: [PATCH v2 net-next] net: fix recent csum changes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20211204125707.tn2w2uqlphqq23l6@skbuf>
Date:   Sat, 4 Dec 2021 12:57:08 +0000
From:   Vladimir Oltean <vladimir.oltean@....com>
To:     Eric Dumazet <eric.dumazet@...il.com>
CC:     "David S . Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>,
        netdev <netdev@...r.kernel.org>,
        Eric Dumazet <edumazet@...gle.com>,
        David Laight <David.Laight@...LAB.COM>,
        David Lebrun <dlebrun@...gle.com>
Subject: Re: [PATCH v2 net-next] net: fix recent csum changes

On Fri, Dec 03, 2021 at 08:53:56PM -0800, Eric Dumazet wrote:
> From: Eric Dumazet <edumazet@...gle.com>
> 
> Vladimir reported csum issues after my recent change in skb_postpull_rcsum()
> 
> Issue here is the following:
> 
> initial skb->csum is the csum of
> 
> [part to be pulled][rest of packet]
> 
> Old code:
>  skb->csum = csum_sub(skb->csum, csum_partial(pull, pull_length, 0));
> 
> New code:
>  skb->csum = ~csum_partial(pull, pull_length, ~skb->csum);
> 
> This is broken if the csum of [pulled part]
> happens to be equal to skb->csum, because end
> result of skb->csum is 0 in new code, instead
> of being 0xffffffff
> 
> David Laight suggested to use
> 
> skb->csum = -csum_partial(pull, pull_length, -skb->csum);
> 
> I based my patches on existing code present in include/net/seg6.h,
> update_csum_diff4() and update_csum_diff16() which might need
> a similar fix.
> 
> I guess that my tests, mostly pulling 40 bytes of IPv6 header
> were not providing enough entropy to hit this bug.
> 
> v2: added wsum_negate() to make sparse happy.
> 
> Fixes: 29c3002644bd ("net: optimize skb_postpull_rcsum()")
> Fixes: 0bd28476f636 ("gro: optimize skb_gro_postpull_rcsum()")
> Signed-off-by: Eric Dumazet <edumazet@...gle.com>
> Reported-by: Vladimir Oltean <vladimir.oltean@....com>
> Suggested-by: David Laight <David.Laight@...LAB.COM>
> Cc: David Lebrun <dlebrun@...gle.com>
> ---

Tested-by: Vladimir Oltean <vladimir.oltean@....com>

Thanks!