netdev - Re: [PATCH net] bonding: fix ICMPv6 header handling when receiving IPv6 messages

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 03 Nov 2022 17:03:59 +0100
From:   Jay Vosburgh <jay.vosburgh@...onical.com>
To:     Hangbin Liu <liuhangbin@...il.com>
cc:     netdev@...r.kernel.org, "David S . Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>,
        Jonathan Toppins <jtoppins@...hat.com>,
        Paolo Abeni <pabeni@...hat.com>,
        David Ahern <dsahern@...il.com>, Liang Li <liali@...hat.com>
Subject: Re: [PATCH net] bonding: fix ICMPv6 header handling when receiving IPv6 messages

Hangbin Liu <liuhangbin@...il.com> wrote:

>On Tue, Nov 01, 2022 at 09:39:22PM +0800, Hangbin Liu wrote:
>> > 	I don't understand this explanation, as ipv6_gro_receive() isn't
>> > called directly by the device drivers, but from within the GRO
>> > processing, e.g., by dev_gro_receive().
>> > 
>> > 	Could you explain how the call paths actually differ?  
>> 
>> Er..Yes, it's a little weird.
>> 
>> I checked if the transport header is set before  __netif_receive_skb_core().
>> The bnx2x driver set it while be2net does not. So the transport header is reset
>> in __netif_receive_skb_core() with be2net.
>> 
>> I also found ipv6_gro_receive() is called before bond_handle_frame() when
>> receive NA message. Not sure which path it go through. I'm not very familiar
>> with driver part. But I can do more investigating.

	I suspect that what you're seeing is caused by bnx2x calling
skb_set_transport_header() in bnx2x_gro_ipv6_csum() to explicitly set
the transport header for IPv6, and benet having no equivalent call.  If
benet were to set the transport header, I think it would happen in
be_rx_compl_process_gro().

	__netif_receive_skb_core() calls skb_reset_transport_header() if
the transport header isn't set, but I presume that doesn't do the right
thing for ICMPv6.

	I don't believe there's any expectation that drivers must set
the transport header at this point, so I tentatively think that what
your patch is trying to do is reasonable.

	Briefly looking at the patch, the commit message needs updating,
and I'm curious to know why pskb_may_pull can't be used.

	-J

>With dump_stack(), it shows bnx2x do calls ipv6_gro_receive().
>PS: I only dump the stack when receive NA.
>
>[   65.537605]  dump_stack_lvl+0x34/0x48
>[   65.541695]  ipv6_gro_receive.cold+0x1b/0x3d
>[   65.546453]  dev_gro_receive+0x16c/0x380
>[   65.550831]  napi_gro_receive+0x64/0x210
>[   65.555206]  bnx2x_rx_int+0x44c/0x820 [bnx2x]
>[   65.560100]  bnx2x_poll+0xe5/0x1d0 [bnx2x]
>[   65.564687]  __napi_poll+0x2c/0x160
>[   65.568579]  net_rx_action+0x296/0x350
>
>Thanks
>Hangbin

---
	-Jay Vosburgh, jay.vosburgh@...onical.com