netdev - Re: [PATCH net v1 4/4] tcp: fix passive TFO socket having invalid NAPI ID

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <72fdc777-eb43-4d15-a6d2-6f652e019cb3@davidwei.uk>
Date: Mon, 16 Jun 2025 17:04:08 -0700
From: David Wei <dw@...idwei.uk>
To: Kuniyuki Iwashima <kuni1840@...il.com>
Cc: andrew+netdev@...n.ch, davem@...emloft.net, dsahern@...nel.org,
 edumazet@...gle.com, horms@...nel.org, kuba@...nel.org, kuniyu@...gle.com,
 ncardwell@...gle.com, netdev@...r.kernel.org, pabeni@...hat.com,
 shuah@...nel.org
Subject: Re: [PATCH net v1 4/4] tcp: fix passive TFO socket having invalid
 NAPI ID

On 2025-06-16 16:05, Kuniyuki Iwashima wrote:
> From: David Wei <dw@...idwei.uk>
> Date: Mon, 16 Jun 2025 15:37:40 -0700
>> On 2025-06-16 12:44, Kuniyuki Iwashima wrote:
>>> From: David Wei <dw@...idwei.uk>
>>> Date: Mon, 16 Jun 2025 11:54:56 -0700
>>>> There is a bug with passive TFO sockets returning an invalid NAPI ID 0
>>>> from SO_INCOMING_NAPI_ID. Normally this is not an issue, but zero copy
>>>> receive relies on a correct NAPI ID to process sockets on the right
>>>> queue.
>>>>
>>>> Fix by adding a skb_mark_napi_id().
>>>>
>>>
>>> Please add Fixes: tag.
>>
>> Not sure which commit to tag as Fixes. 5b7ed089 originally created
>> tcp_fastopen_create_child() in tcp_fastopen.c by copying from
>> tcp_v4_conn_req_fastopen(). The bug has been around since either when
>> TFO was added in 168a8f58 or when SO_INCOMING_NAPI_ID was added in
>> 6d433902. What's your preference?
> 
> 6d4339028b35 makes sense to me as SO_INCOMING_NAPI_ID (2017) was
> not available as of the TFO commits (2012, 2014).

Makes sense, I'll use 6d433902. Thanks.

> 
> 
>>
>>>
>>>> Signed-off-by: David Wei <dw@...idwei.uk>
>>>> ---
>>>>    net/ipv4/tcp_fastopen.c | 3 +++
>>>>    1 file changed, 3 insertions(+)
>>>>
>>>> diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
>>>> index 9b83d639b5ac..d0ed1779861b 100644
>>>> --- a/net/ipv4/tcp_fastopen.c
>>>> +++ b/net/ipv4/tcp_fastopen.c
>>>> @@ -3,6 +3,7 @@
>>>>    #include <linux/tcp.h>
>>>>    #include <linux/rcupdate.h>
>>>>    #include <net/tcp.h>
>>>> +#include <net/busy_poll.h>
>>>>    
>>>>    void tcp_fastopen_init_key_once(struct net *net)
>>>>    {
>>>> @@ -279,6 +280,8 @@ static struct sock *tcp_fastopen_create_child(struct sock *sk,
>>>>    
>>>>    	refcount_set(&req->rsk_refcnt, 2);
>>>>    
>>>> +	sk_mark_napi_id(child, skb);
>>>
>>> I think sk_mark_napi_id_set() is better here.
>>
>> Sure, I can switch to sk_mark_napi_id_set().
>>
>>>
>>>
>>>> +
>>>>    	/* Now finish processing the fastopen child socket. */
>>>>    	tcp_init_transfer(child, BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB, skb);
>>>>    
>>>> -- 
>>>> 2.47.1
>>>>