netdev - Re: [PATCH net-next] ipv4: Convert ->flowi4_tos to dscp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aKbDCJWjMpUEOtXe@shredder>
Date: Thu, 21 Aug 2025 09:56:08 +0300
From: Ido Schimmel <idosch@...dia.com>
To: Guillaume Nault <gnault@...hat.com>
Cc: David Miller <davem@...emloft.net>, Jakub Kicinski <kuba@...nel.org>,
	Paolo Abeni <pabeni@...hat.com>, Eric Dumazet <edumazet@...gle.com>,
	netdev@...r.kernel.org, Simon Horman <horms@...nel.org>,
	Taehee Yoo <ap420073@...il.com>,
	Andrew Lunn <andrew+netdev@...n.ch>,
	Saeed Mahameed <saeedm@...dia.com>,
	Leon Romanovsky <leon@...nel.org>, Tariq Toukan <tariqt@...dia.com>,
	Mark Bloch <mbloch@...dia.com>,
	Edward Cree <ecree.xilinx@...il.com>,
	Pablo Neira Ayuso <pablo@...filter.org>,
	Harald Welte <laforge@...monks.org>,
	David Ahern <dsahern@...nel.org>,
	Steven Rostedt <rostedt@...dmis.org>,
	Masami Hiramatsu <mhiramat@...nel.org>,
	Mathieu Desnoyers <mathieu.desnoyers@...icios.com>,
	Martin KaFai Lau <martin.lau@...ux.dev>,
	Daniel Borkmann <daniel@...earbox.net>,
	John Fastabend <john.fastabend@...il.com>,
	Stanislav Fomichev <sdf@...ichev.me>,
	Alexei Starovoitov <ast@...nel.org>,
	Andrii Nakryiko <andrii@...nel.org>,
	Eduard Zingerman <eddyz87@...il.com>, Song Liu <song@...nel.org>,
	Yonghong Song <yonghong.song@...ux.dev>,
	KP Singh <kpsingh@...nel.org>, Hao Luo <haoluo@...gle.com>,
	Jiri Olsa <jolsa@...nel.org>,
	Jozsef Kadlecsik <kadlec@...filter.org>,
	Florian Westphal <fw@...len.de>,
	Steffen Klassert <steffen.klassert@...unet.com>,
	Herbert Xu <herbert@...dor.apana.org.au>,
	Marcelo Ricardo Leitner <marcelo.leitner@...il.com>,
	Xin Long <lucien.xin@...il.com>
Subject: Re: [PATCH net-next] ipv4: Convert ->flowi4_tos to dscp_t.

On Thu, Aug 21, 2025 at 01:32:03AM +0200, Guillaume Nault wrote:
> Convert the ->flowic_tos field of struct flowi_common from __u8 to
> dscp_t, rename it ->flowic_dscp and propagate these changes to struct
> flowi and struct flowi4.
> 
> We've had several bugs in the past where ECN bits could interfere with
> IPv4 routing, because these bits were not properly cleared when setting
> ->flowi4_tos. These bugs should be fixed now and the dscp_t type has
> been introduced to ensure that variables carrying DSCP values don't
> accidentally have any ECN bits set. Several variables and structure
> fields have been converted to dscp_t already, but the main IPv4 routing
> structure, struct flowi4, is still using a __u8. To avoid any future
> regression, this patch converts it to dscp_t.
> 
> There are many users to convert at once. Fortunately, around half of
> ->flowi4_tos users already have a dscp_t value at hand, which they
> currently convert to __u8 using inet_dscp_to_dsfield(). For all of
> these users, we just need to drop that conversion.
> 
> But, although we try to do the __u8 <-> dscp_t conversions at the
> boundaries of the network or of user space, some places still store
> TOS/DSCP variables as __u8 in core networking code. Some structure
> fields, like struct ip_tunnel_key::tos could be converted to dscp_t,
> but that would require a lot of work, so this is left for later. Other
> places can't be converted, for example because the data structure is
> part of UAPI or because the same variable or field is also used for
> handling ECN in other parts of the code. In all of these cases where we
> don't have a dscp_t variable at hand, we need to use
> inet_dsfield_to_dscp() when interacting with ->flowi4_dscp.
> 
> Signed-off-by: Guillaume Nault <gnault@...hat.com>

Reviewed-by: Ido Schimmel <idosch@...dia.com>

Thanks! One nit below

[...]

> diff --git a/net/core/filter.c b/net/core/filter.c
> index da391e2b0788..c75f95c60af3 100644
> --- a/net/core/filter.c
> +++ b/net/core/filter.c
> @@ -2373,7 +2373,7 @@ static int __bpf_redirect_neigh_v4(struct sk_buff *skb, struct net_device *dev,
>  		struct flowi4 fl4 = {
>  			.flowi4_flags = FLOWI_FLAG_ANYSRC,
>  			.flowi4_mark  = skb->mark,
> -			.flowi4_tos   = inet_dscp_to_dsfield(ip4h_dscp(ip4h)),
> +			.flowi4_dscp   = ip4h_dscp(ip4h),

Nit: alignment is off

>  			.flowi4_oif   = dev->ifindex,
>  			.flowi4_proto = ip4h->protocol,
>  			.daddr	      = ip4h->daddr,