netdev - [PATCH net v4 0/2] net: gro: add flush/flush_id checks and fix wrong offset in udp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20240430143555.126083-1-richardbgobert@gmail.com>
Date: Tue, 30 Apr 2024 16:35:53 +0200
From: Richard Gobert <richardbgobert@...il.com>
To: davem@...emloft.net,
	edumazet@...gle.com,
	kuba@...nel.org,
	pabeni@...hat.com,
	dsahern@...nel.org,
	willemdebruijn.kernel@...il.com,
	alobakin@...me,
	netdev@...r.kernel.org,
	linux-kernel@...r.kernel.org
Cc: Richard Gobert <richardbgobert@...il.com>
Subject: [PATCH net v4 0/2] net: gro: add flush/flush_id checks and fix wrong offset in udp

This series fixes a bug in the complete phase of UDP in GRO, in which
socket lookup fails due to using network_header when parsing encapsulated
packets. The fix is to add network_offset and inner_network_offset to
napi_gro_cb and use these offsets for socket lookup.

In addition p->flush/flush_id should be checked in all UDP flows. The
same logic from tcp_gro_receive is applied for all flows in
udp_gro_receive_segment. This prevents packets with mismatching network
headers (flush/flush_id turned on) from merging in UDP GRO.

The original series includes a change to vxlan test which adds the local
parameter to prevent similar future bugs. I plan to submit it separately to
net-next.

This series is part of a previously submitted series to net-next:
https://lore.kernel.org/all/20240408141720.98832-1-richardbgobert@gmail.com/

v3 -> v4:
 - Store network offsets, and use them only in udp_gro_complete flows
 - Correct commit hash used in Fixes tag
 - v3:
 https://lore.kernel.org/netdev/20240424163045.123528-1-richardbgobert@gmail.com/

v2 -> v3:
 - Add network_offsets and fix udp bug in a single commit to make backporting easier
 - Write to inner_network_offset in {inet,ipv6}_gro_receive
 - Use network_offsets union in tcp[46]_gro_complete as well
 - v2:
 https://lore.kernel.org/netdev/20240419153542.121087-1-richardbgobert@gmail.com/

v1 -> v2:
 - Use network_offsets instead of p_poff param as suggested by Willem
 - Check flush before postpull, and for all UDP GRO flows
 - v1:
 https://lore.kernel.org/netdev/20240412152120.115067-1-richardbgobert@gmail.com/

Richard Gobert (2):
  net: gro: fix udp bad offset in socket lookup by adding {inner_}network_offset to napi_gro_cb
  net: gro: add flush check in udp_gro_receive_segment

 include/net/gro.h      |  9 +++++++++
 net/8021q/vlan_core.c  |  2 ++
 net/core/gro.c         |  1 +
 net/ipv4/af_inet.c     |  1 +
 net/ipv4/udp.c         |  3 ++-
 net/ipv4/udp_offload.c | 15 +++++++++++++--
 net/ipv6/ip6_offload.c |  1 +
 net/ipv6/udp.c         |  3 ++-
 net/ipv6/udp_offload.c |  3 ++-
 9 files changed, 33 insertions(+), 5 deletions(-)

-- 
2.36.1