netdev - Re: [PATCH net-next 13/17] udp: Support gro_ipv4_max

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <61b001c3-bf6f-410b-aa56-2b0c2c93523e@redhat.com>
Date: Thu, 25 Sep 2025 16:22:00 +0200
From: Paolo Abeni <pabeni@...hat.com>
To: Maxim Mikityanskiy <maxtram95@...il.com>,
 Daniel Borkmann <daniel@...earbox.net>, "David S. Miller"
 <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>,
 Jakub Kicinski <kuba@...nel.org>,
 Willem de Bruijn <willemdebruijn.kernel@...il.com>,
 David Ahern <dsahern@...nel.org>, Nikolay Aleksandrov <razor@...ckwall.org>
Cc: netdev@...r.kernel.org, tcpdump-workers@...ts.tcpdump.org,
 Guy Harris <gharris@...ic.net>, Michael Richardson <mcr@...delman.ca>,
 Denis Ovsienko <denis@...ienko.info>, Xin Long <lucien.xin@...il.com>,
 Maxim Mikityanskiy <maxim@...valent.com>
Subject: Re: [PATCH net-next 13/17] udp: Support gro_ipv4_max_size > 65536

On 9/25/25 4:15 PM, Paolo Abeni wrote:
> On 9/23/25 3:47 PM, Maxim Mikityanskiy wrote:
>> From: Maxim Mikityanskiy <maxim@...valent.com>
>>
>> From: Maxim Mikityanskiy <maxim@...valent.com>
>>
>> Currently, gro_max_size and gro_ipv4_max_size can be set to values
>> bigger than 65536, and GRO will happily aggregate UDP to the configured
>> size (for example, with TCP traffic in VXLAN tunnels). However,
>> udp_gro_complete uses the 16-bit length field in the UDP header to store
>> the length of the aggregated packet. It leads to the packet truncation
>> later in __udp4_lib_rcv.
>>
>> Fix this by storing 0 to the UDP length field and by restoring the real
>> length from skb->len in __udp4_lib_rcv.
>>
>> Signed-off-by: Maxim Mikityanskiy <maxim@...valent.com>
> 
> If I read correctly, after this patch plain UDP GRO can start
> aggregating packets up to a total len above 64K.

Re-reading the patch, I now thing the above is not true.

But geneve/vxlan will do that before the end of the series, so the
following should still stand:

> Potentially every point in the RX/TX path can unexpectedly process UDP
> GSO packets with uh->len == 0 and skb->len > 64K which sounds
> potentially dangerous. How about adding an helper to access the UDP len,
> and use it everywhere tree wide (except possibly H/W NIC rx path)?
> 
> You could pin-point all the relevant location changing in a local build
> of your the udphdr len field and looking for allmod build breakge.