netdev - Re: [PATCH net v2 1/4] udp: do not accept non-tunnel GSO skbs landing in a tunnel

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <99098715-6b36-456a-869e-39f9b211a8bc@blackwall.org>
Date: Wed, 20 Mar 2024 12:34:01 +0200
From: Nikolay Aleksandrov <razor@...ckwall.org>
To: Antoine Tenart <atenart@...nel.org>, davem@...emloft.net,
 kuba@...nel.org, pabeni@...hat.com, edumazet@...gle.com
Cc: steffen.klassert@...unet.com, willemdebruijn.kernel@...il.com,
 netdev@...r.kernel.org, Willem de Bruijn <willemb@...gle.com>
Subject: Re: [PATCH net v2 1/4] udp: do not accept non-tunnel GSO skbs landing
 in a tunnel

On 3/19/24 11:31, Antoine Tenart wrote:
[snip]
> @@ -163,6 +181,16 @@ static inline bool udp_unexpected_gso(struct sock *sk, struct sk_buff *skb)
>   	    !udp_test_bit(ACCEPT_FRAGLIST, sk))
>   		return true;
>   
> +	/* GSO packets lacking the SKB_GSO_UDP_TUNNEL/_CUSM bits might still

s/CUSM/CSUM/

> +	 * land in a tunnel as the socket check in udp_gro_receive cannot be
> +	 * foolproof.
> +	 */
> +	if (udp_encap_needed() &&
> +	    READ_ONCE(udp_sk(sk)->encap_rcv) &&
> +	    !(skb_shinfo(skb)->gso_type &
> +	      (SKB_GSO_UDP_TUNNEL | SKB_GSO_UDP_TUNNEL_CSUM)))
> +		return true;
> +
>   	return false;
>   }
>   
> diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
> index b9880743765c..e9719afe91cf 100644
> --- a/net/ipv4/udp_offload.c
> +++ b/net/ipv4/udp_offload.c
> @@ -551,8 +551,10 @@ struct sk_buff *udp_gro_receive(struct list_head *head, struct sk_buff *skb,
>   	unsigned int off = skb_gro_offset(skb);
>   	int flush = 1;
>   
> -	/* we can do L4 aggregation only if the packet can't land in a tunnel
> -	 * otherwise we could corrupt the inner stream
> +	/* We can do L4 aggregation only if the packet can't land in a tunnel
> +	 * otherwise we could corrupt the inner stream. Detecting such packets
> +	 * cannot be foolproof and the aggregation might still happen in some
> +	 * cases. Such packets should be caught in udp_unexpected_gso later.
>   	 */
>   	NAPI_GRO_CB(skb)->is_flist = 0;
>   	if (!sk || !udp_sk(sk)->gro_receive) {