netdev - Re: [PATCH net] virtio: fix GSO with frames unaligned to size

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAF=yD-Kz3PRncy4N0LkTSDGm95Zg7yfKDm+BOHBs4NfkEDSJUw@mail.gmail.com>
Date: Thu, 25 Jul 2024 10:27:15 -0400
From: Willem de Bruijn <willemdebruijn.kernel@...il.com>
To: Denis Arefev <arefev@...mel.ru>
Cc: kuba@...nel.org, davem@...emloft.net, edumazet@...gle.com, 
	eperezma@...hat.com, jasowang@...hat.com, linux-kselftest@...r.kernel.org, 
	mst@...hat.com, netdev@...r.kernel.org, pabeni@...hat.com, shuah@...nel.org, 
	virtualization@...ts.linux.dev, xuanzhuo@...ux.alibaba.com
Subject: Re: [PATCH net] virtio: fix GSO with frames unaligned to size

On Thu, Jul 25, 2024 at 5:22 AM Denis Arefev <arefev@...mel.ru> wrote:
>
> I checked the patch on three reproducers and all three DEFINITELY broke the core.
>
> There are two malfunctions.
>
> 1. No flag skb_shinfo(skb)->tx_flags |= SKBFL_SHARED_FRAG;
>  If it is not set then __skb_linearize will not be executed in skb_checksum_help.
>  sk_buff remains fragmented (non-linear) and this is the first warning.
>  OR add skb_shinfo(skb)->tx_flags |= SKBFL_SHARED_FRAG.
>  OR ask Eric Dumazet (cef401de7be8c). Is checking if (skb_has_shared_frag(skb)) so important?
>  in the skb_checksum_help function, is it enough if (skb_is_nonlinear(skb)) ?

Thanks for sharing the reproducers. Having a look.

On SKBFL_SHARED_FRAG: as Eric's commit indicates, that flag identifies
packets with contents writable from userspace, such as vmsplice or
later introduced MSG_ZEROCOPY. That is not the case for these packets.

Setting the flag may have the desired effect of triggering
linearization, but it does not match the intent of the flag.

I think we can catch these bad packets with illegal csum_start and
simply drop them. The question is where is the best place to detect
them. I gave one suggestion. Great to have reproducers. Let's see if
that indeed addresses them.