netdev - Re: [PATH net 1/2] net: ip: add drop reasons when handling ip fragments

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CANn89i+TsY67y-pCkOkJHsh11Leg77Ek7n2-j6X6ed-U20eR=g@mail.gmail.com>
Date: Thu, 23 Oct 2025 23:43:25 -0700
From: Eric Dumazet <edumazet@...gle.com>
To: Yonglong Li <liyonglong@...natelecom.cn>
Cc: netdev@...r.kernel.org, davem@...emloft.net, dsahern@...nel.org, 
	pabeni@...hat.com, kuba@...nel.org, horms@...nel.org
Subject: Re: [PATH net 1/2] net: ip: add drop reasons when handling ip fragments

On Thu, Oct 23, 2025 at 11:23 PM Yonglong Li <liyonglong@...natelecom.cn> wrote:
>
> 1, add new drop reason FRAG_FAILED, and use it in ip_do_fragment
> 2, use drop reasons PKT_TOO_BIG in ip_fragment
>
> Signed-off-by: Yonglong Li <liyonglong@...natelecom.cn>
> ---
>  include/net/dropreason-core.h | 3 +++
>  net/ipv4/ip_output.c          | 6 +++---
>  2 files changed, 6 insertions(+), 3 deletions(-)
>
> diff --git a/include/net/dropreason-core.h b/include/net/dropreason-core.h
> index 58d91cc..7da80f4 100644
> --- a/include/net/dropreason-core.h
> +++ b/include/net/dropreason-core.h
> @@ -99,6 +99,7 @@
>         FN(DUP_FRAG)                    \
>         FN(FRAG_REASM_TIMEOUT)          \
>         FN(FRAG_TOO_FAR)                \
> +       FN(FRAG_FAILED)                 \
>         FN(TCP_MINTTL)                  \
>         FN(IPV6_BAD_EXTHDR)             \
>         FN(IPV6_NDISC_FRAG)             \
> @@ -500,6 +501,8 @@ enum skb_drop_reason {
>          * (/proc/sys/net/ipv4/ipfrag_max_dist)
>          */
>         SKB_DROP_REASON_FRAG_TOO_FAR,
> +       /* do ip/ip6 fragment failed */
> +       SKB_DROP_REASON_FRAG_FAILED,
>         /**
>          * @SKB_DROP_REASON_TCP_MINTTL: ipv4 ttl or ipv6 hoplimit below
>          * the threshold (IP_MINTTL or IPV6_MINHOPCOUNT).
> diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
> index ff11d3a..879fe49 100644
> --- a/net/ipv4/ip_output.c
> +++ b/net/ipv4/ip_output.c
> @@ -588,7 +588,7 @@ static int ip_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
>                 IP_INC_STATS(net, IPSTATS_MIB_FRAGFAILS);
>                 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
>                           htonl(mtu));
> -               kfree_skb(skb);
> +               kfree_skb_reason(skb, SKB_DROP_REASON_PKT_TOO_BIG);

This part looks fine.

>                 return -EMSGSIZE;
>         }
>
> @@ -871,7 +871,7 @@ int ip_do_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
>                         return 0;
>                 }
>
> -               kfree_skb_list(iter.frag);
> +               kfree_skb_list_reason(iter.frag, SKB_DROP_REASON_FRAG_FAILED);
>
>                 IP_INC_STATS(net, IPSTATS_MIB_FRAGFAILS);
>                 return err;
> @@ -923,7 +923,7 @@ int ip_do_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
>         return err;
>
>  fail:
> -       kfree_skb(skb);
> +       kfree_skb_reason(skb, SKB_DROP_REASON_FRAG_FAILED);

There are many different reasons for the possible failures ?
skb_checksum_help() error,
ip_frag_next() error
output() error.

I think that having the distinction could really help, especially the
output() one...