netdev - Re: [PATCH net v1 4/4] tcp: fix passive TFO socket having invalid NAPI ID

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <e725afd8-610b-457a-b30e-963cbf8930af@davidwei.uk>
Date: Mon, 16 Jun 2025 15:37:40 -0700
From: David Wei <dw@...idwei.uk>
To: Kuniyuki Iwashima <kuni1840@...il.com>
Cc: andrew+netdev@...n.ch, davem@...emloft.net, dsahern@...nel.org,
 edumazet@...gle.com, horms@...nel.org, kuba@...nel.org, kuniyu@...gle.com,
 ncardwell@...gle.com, netdev@...r.kernel.org, pabeni@...hat.com,
 shuah@...nel.org
Subject: Re: [PATCH net v1 4/4] tcp: fix passive TFO socket having invalid
 NAPI ID

On 2025-06-16 12:44, Kuniyuki Iwashima wrote:
> From: David Wei <dw@...idwei.uk>
> Date: Mon, 16 Jun 2025 11:54:56 -0700
>> There is a bug with passive TFO sockets returning an invalid NAPI ID 0
>> from SO_INCOMING_NAPI_ID. Normally this is not an issue, but zero copy
>> receive relies on a correct NAPI ID to process sockets on the right
>> queue.
>>
>> Fix by adding a skb_mark_napi_id().
>>
> 
> Please add Fixes: tag.

Not sure which commit to tag as Fixes. 5b7ed089 originally created
tcp_fastopen_create_child() in tcp_fastopen.c by copying from
tcp_v4_conn_req_fastopen(). The bug has been around since either when
TFO was added in 168a8f58 or when SO_INCOMING_NAPI_ID was added in
6d433902. What's your preference?

> 
>> Signed-off-by: David Wei <dw@...idwei.uk>
>> ---
>>   net/ipv4/tcp_fastopen.c | 3 +++
>>   1 file changed, 3 insertions(+)
>>
>> diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
>> index 9b83d639b5ac..d0ed1779861b 100644
>> --- a/net/ipv4/tcp_fastopen.c
>> +++ b/net/ipv4/tcp_fastopen.c
>> @@ -3,6 +3,7 @@
>>   #include <linux/tcp.h>
>>   #include <linux/rcupdate.h>
>>   #include <net/tcp.h>
>> +#include <net/busy_poll.h>
>>   
>>   void tcp_fastopen_init_key_once(struct net *net)
>>   {
>> @@ -279,6 +280,8 @@ static struct sock *tcp_fastopen_create_child(struct sock *sk,
>>   
>>   	refcount_set(&req->rsk_refcnt, 2);
>>   
>> +	sk_mark_napi_id(child, skb);
> 
> I think sk_mark_napi_id_set() is better here.

Sure, I can switch to sk_mark_napi_id_set().

> 
> 
>> +
>>   	/* Now finish processing the fastopen child socket. */
>>   	tcp_init_transfer(child, BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB, skb);
>>   
>> -- 
>> 2.47.1
>>