netdev - Re: [PATCH net] tcp: fix skb_copy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <0fa1d0a7-172e-12ca-99c5-d4cf25f2bfef@kernel.org>
Date:   Thu, 27 Apr 2023 15:08:59 -0600
From:   David Ahern <dsahern@...nel.org>
To:     Eric Dumazet <edumazet@...gle.com>,
        "David S . Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>,
        Paolo Abeni <pabeni@...hat.com>
Cc:     netdev@...r.kernel.org, eric.dumazet@...il.com,
        Xin Long <lucien.xin@...il.com>,
        Willem de Bruijn <willemb@...gle.com>,
        Coco Li <lixiaoyan@...gle.com>
Subject: Re: [PATCH net] tcp: fix skb_copy_ubufs() vs BIG TCP

On 4/27/23 1:24 PM, Eric Dumazet wrote:
> David Ahern reported crashes in skb_copy_ubufs() caused by TCP tx zerocopy
> using hugepages, and skb length bigger than ~68 KB.
> 
> skb_copy_ubufs() assumed it could copy all payload using up to
> MAX_SKB_FRAGS order-0 pages.
> 
> This assumption broke when BIG TCP was able to put up to 512 KB per skb.

Just an FYI - the problem was triggered at 128kB.

> 
> We did not hit this bug at Google because we use CONFIG_MAX_SKB_FRAGS=45
> and limit gso_max_size to 180000.
> 
> A solution is to use higher order pages if needed.
> 
> Fixes: 7c4e983c4f3c ("net: allow gso_max_size to exceed 65536")
> Reported-by: David Ahern <dsahern@...nel.org>
> Link: https://lore.kernel.org/netdev/c70000f6-baa4-4a05-46d0-4b3e0dc1ccc8@gmail.com/T/
> Signed-off-by: Eric Dumazet <edumazet@...gle.com>
> Cc: Xin Long <lucien.xin@...il.com>
> Cc: Willem de Bruijn <willemb@...gle.com>
> Cc: Coco Li <lixiaoyan@...gle.com>
> ---
>  net/core/skbuff.c | 20 ++++++++++++++------
>  1 file changed, 14 insertions(+), 6 deletions(-)
> 


Reviewed-by: David Ahern <dsahern@...nel.org>
Tested-by: David Ahern <dsahern@...nel.org>

Thanks, Eric. With ConnectX-6's connected back-to-back and S/W only
settings (max GRO, GSO size and 9000 MTU) able to hit ~160G with both
IPv4 and IPv6. I added nr_frags to the net_dev_xmit to verify various
permutations; no issues with the patch.