| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <a18a6bef-0262-4c72-86c9-8df72c8c7415@gmail.com>
Date: Mon, 15 Sep 2025 10:46:57 +0200
From: Richard Gobert <richardbgobert@...il.com>
To: Willem de Bruijn <willemdebruijn.kernel@...il.com>, netdev@...r.kernel.org
Cc: davem@...emloft.net, edumazet@...gle.com, kuba@...nel.org,
pabeni@...hat.com, horms@...nel.org, corbet@....net, saeedm@...dia.com,
tariqt@...dia.com, mbloch@...dia.com, leon@...nel.org,
ecree.xilinx@...il.com, dsahern@...nel.org, ncardwell@...gle.com,
kuniyu@...gle.com, shuah@...nel.org, sdf@...ichev.me,
aleksander.lobakin@...el.com, florian.fainelli@...adcom.com,
alexander.duyck@...il.com, linux-kernel@...r.kernel.org,
linux-net-drivers@....com
Subject: Re: [PATCH net-next v4 2/5] net: gro: only merge packets with
incrementing or fixed outer ids
Willem de Bruijn wrote:
> Richard Gobert wrote:
>> Only merge encapsulated packets if their outer IDs are either
>> incrementing or fixed, just like for inner IDs and IDs of non-encapsulated
>> packets.
>>
>> Add another ip_fixedid bit for a total of two bits: one for outer IDs (and
>> for unencapsulated packets) and one for inner IDs.
>>
>> This commit preserves the current behavior of GSO where only the IDs of the
>> inner-most headers are restored correctly.
>>
>> Signed-off-by: Richard Gobert <richardbgobert@...il.com>
>> ---
>> include/net/gro.h | 30 +++++++++++++++---------------
>> net/ipv4/tcp_offload.c | 5 ++++-
>> 2 files changed, 19 insertions(+), 16 deletions(-)
>>
>> diff --git a/include/net/gro.h b/include/net/gro.h
>> index 87c68007f949..322c5517f508 100644
>> --- a/include/net/gro.h
>> +++ b/include/net/gro.h
>> @@ -75,7 +75,7 @@ struct napi_gro_cb {
>> u8 is_fou:1;
>>
>> /* Used to determine if ipid_offset can be ignored */
>> - u8 ip_fixedid:1;
>> + u8 ip_fixedid:2;
>>
>> /* Number of gro_receive callbacks this packet already went through */
>> u8 recursion_counter:4;
>> @@ -442,29 +442,26 @@ static inline __wsum ip6_gro_compute_pseudo(const struct sk_buff *skb,
>> }
>>
>> static inline int inet_gro_flush(const struct iphdr *iph, const struct iphdr *iph2,
>> - struct sk_buff *p, bool outer)
>> + struct sk_buff *p, bool inner)
>> {
>> const u32 id = ntohl(*(__be32 *)&iph->id);
>> const u32 id2 = ntohl(*(__be32 *)&iph2->id);
>> const u16 ipid_offset = (id >> 16) - (id2 >> 16);
>> const u16 count = NAPI_GRO_CB(p)->count;
>> const u32 df = id & IP_DF;
>> - int flush;
>>
>> /* All fields must match except length and checksum. */
>> - flush = (iph->ttl ^ iph2->ttl) | (iph->tos ^ iph2->tos) | (df ^ (id2 & IP_DF));
>> -
>> - if (flush | (outer && df))
>> - return flush;
>> + if ((iph->ttl ^ iph2->ttl) | (iph->tos ^ iph2->tos) | (df ^ (id2 & IP_DF)))
>> + return true;
>>
>> /* When we receive our second frame we can make a decision on if we
>> * continue this flow as an atomic flow with a fixed ID or if we use
>> * an incrementing ID.
>> */
>> if (count == 1 && df && !ipid_offset)
>> - NAPI_GRO_CB(p)->ip_fixedid = true;
>> + NAPI_GRO_CB(p)->ip_fixedid |= 1 << inner;
>>
>> - return ipid_offset ^ (count * !NAPI_GRO_CB(p)->ip_fixedid);
>> + return ipid_offset ^ (count * !(NAPI_GRO_CB(p)->ip_fixedid & (1 << inner)));
>> }
>>
>> static inline int ipv6_gro_flush(const struct ipv6hdr *iph, const struct ipv6hdr *iph2)
>> @@ -479,7 +476,7 @@ static inline int ipv6_gro_flush(const struct ipv6hdr *iph, const struct ipv6hdr
>>
>> static inline int __gro_receive_network_flush(const void *th, const void *th2,
>> struct sk_buff *p, const u16 diff,
>> - bool outer)
>> + bool inner)
>> {
>> const void *nh = th - diff;
>> const void *nh2 = th2 - diff;
>> @@ -487,19 +484,22 @@ static inline int __gro_receive_network_flush(const void *th, const void *th2,
>> if (((struct iphdr *)nh)->version == 6)
>> return ipv6_gro_flush(nh, nh2);
>> else
>> - return inet_gro_flush(nh, nh2, p, outer);
>> + return inet_gro_flush(nh, nh2, p, inner);
>> }
>>
>> static inline int gro_receive_network_flush(const void *th, const void *th2,
>> struct sk_buff *p)
>> {
>> - const bool encap_mark = NAPI_GRO_CB(p)->encap_mark;
>> int off = skb_transport_offset(p);
>> int flush;
>> + int diff;
>>
>> - flush = __gro_receive_network_flush(th, th2, p, off - NAPI_GRO_CB(p)->network_offset, encap_mark);
>> - if (encap_mark)
>> - flush |= __gro_receive_network_flush(th, th2, p, off - NAPI_GRO_CB(p)->inner_network_offset, false);
>> + diff = off - NAPI_GRO_CB(p)->network_offset;
>> + flush = __gro_receive_network_flush(th, th2, p, diff, false);
>> + if (NAPI_GRO_CB(p)->encap_mark) {
>> + diff = off - NAPI_GRO_CB(p)->inner_network_offset;
>> + flush |= __gro_receive_network_flush(th, th2, p, diff, true);
>> + }
>
> nit: this diff introduction is not needed. The patch is easier to
> parse without the change. Even if line length will (still) be longer.
>
>>
>> return flush;
>> }
>> diff --git a/net/ipv4/tcp_offload.c b/net/ipv4/tcp_offload.c
>> index e6612bd84d09..1949eede9ec9 100644
>> --- a/net/ipv4/tcp_offload.c
>> +++ b/net/ipv4/tcp_offload.c
>> @@ -471,6 +471,7 @@ INDIRECT_CALLABLE_SCOPE int tcp4_gro_complete(struct sk_buff *skb, int thoff)
>> const u16 offset = NAPI_GRO_CB(skb)->network_offsets[skb->encapsulation];
>> const struct iphdr *iph = (struct iphdr *)(skb->data + offset);
>> struct tcphdr *th = tcp_hdr(skb);
>> + bool is_fixedid;
>>
>> if (unlikely(NAPI_GRO_CB(skb)->is_flist)) {
>> skb_shinfo(skb)->gso_type |= SKB_GSO_FRAGLIST | SKB_GSO_TCPV4;
>> @@ -484,8 +485,10 @@ INDIRECT_CALLABLE_SCOPE int tcp4_gro_complete(struct sk_buff *skb, int thoff)
>> th->check = ~tcp_v4_check(skb->len - thoff, iph->saddr,
>> iph->daddr, 0);
>>
>> + is_fixedid = (NAPI_GRO_CB(skb)->ip_fixedid >> skb->encapsulation) & 1;
>> +
>> skb_shinfo(skb)->gso_type |= SKB_GSO_TCPV4 |
>> - (NAPI_GRO_CB(skb)->ip_fixedid * SKB_GSO_TCP_FIXEDID);
>> + (is_fixedid * SKB_GSO_TCP_FIXEDID);
>
> Similar to how gro_receive_network_flush is called from both transport
> layers, TCP and UDP, this is needed in udp_gro_complete_segment too?
>
> Existing equivalent block is entirely missing there.
>
> The deeper issue is that this is named TCP_FIXEDID, but in reality it
> is IPV4_FIXEDID and applies to all transport layer protocols on top.
>
> Perhaps not to fix in this series. But a limitation of USO in the
> meantime.
>
Yes, I noticed this when working on this change and there is no good
reason not to do this for UDP as well. I think we should address this in
a separate patch series.
>>
>> tcp_gro_complete(skb);
>> return 0;
>> --
>> 2.36.1
>>
>
>
Powered by blists - more mailing lists