netdev - Re: [PATCH v3 net-next 01/10] net: introduce mangleid

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CANn89iKk+BPOxCYr1+w85+hd3j7ugLB7EYmm+NdN=4XCsecAig@mail.gmail.com>
Date: Wed, 14 Jan 2026 19:07:08 +0100
From: Eric Dumazet <edumazet@...gle.com>
To: Paolo Abeni <pabeni@...hat.com>
Cc: netdev@...r.kernel.org, "David S. Miller" <davem@...emloft.net>, 
	Jakub Kicinski <kuba@...nel.org>, Simon Horman <horms@...nel.org>, 
	Donald Hunter <donald.hunter@...il.com>, Andrew Lunn <andrew+netdev@...n.ch>, 
	Shuah Khan <shuah@...nel.org>, Willem de Bruijn <willemdebruijn.kernel@...il.com>, sdf@...ichev.me, 
	petrm@...dia.com, razor@...ckwall.org, idosch@...dia.com
Subject: Re: [PATCH v3 net-next 01/10] net: introduce mangleid_features

On Wed, Jan 14, 2026 at 6:21 PM Paolo Abeni <pabeni@...hat.com> wrote:
>
> Some/most devices implementing gso_partial need to disable the GSO partial
> features when the IP ID can't be mangled; to that extend each of them
> implements something alike the following:
>
>         if (skb->encapsulation && !(features & NETIF_F_TSO_MANGLEID))
>                 features &= ~NETIF_F_TSO;
>
> in the ndo_features_check() op, which leads to a bit of duplicate code.
>
> Later patch in the series will implement GSO partial support for virtual
> device, and the current status quo will require more duplicate code and
> a new indirect call in the TX path for such devices.
>
> Introduce the mangleid_features mask, allowing the core to disable NIC
> features based on/requiring MANGLEID, without any further intervention
> from the driver.
>
> The same functionality could be alternatively implemented adding a single
> boolean flag to the struct net_device, but would require an additional
> checks in ndo_features_check().
>
> Also note that the above mentioned action is incorrect if the NIC
> additionally implements NETIF_F_GSO_UDP_L4, mangleid_features
> transparently handle even such a case.
>
> Signed-off-by: Paolo Abeni <pabeni@...hat.com>
> ---
>  include/linux/netdevice.h | 5 ++++-
>  net/core/dev.c            | 4 +++-
>  2 files changed, 7 insertions(+), 2 deletions(-)
>
> diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
> index d99b0fbc1942..23a698b70de1 100644
> --- a/include/linux/netdevice.h
> +++ b/include/linux/netdevice.h
> @@ -1830,7 +1830,9 @@ enum netdev_reg_state {
>   *                             and drivers will need to set them appropriately.
>   *
>   *     @mpls_features: Mask of features inheritable by MPLS
> - *     @gso_partial_features: value(s) from NETIF_F_GSO\*
> + *     @gso_partial_features: value(s) from NETIF_F_GSO
> + *     @mangleid_features:     Mask of features requiring MANGLEID, will be
> + *                             disabled together with the latter.
>   *
>   *     @ifindex:       interface index
>   *     @group:         The group the device belongs to
> @@ -2219,6 +2221,7 @@ struct net_device {
>         netdev_features_t       vlan_features;
>         netdev_features_t       hw_enc_features;
>         netdev_features_t       mpls_features;
> +       netdev_features_t       mangleid_features;
>
>         unsigned int            min_mtu;
>         unsigned int            max_mtu;
> diff --git a/net/core/dev.c b/net/core/dev.c
> index c711da335510..6154f306ed76 100644
> --- a/net/core/dev.c
> +++ b/net/core/dev.c
> @@ -3788,8 +3788,10 @@ static netdev_features_t gso_features_check(const struct sk_buff *skb,
>                 struct iphdr *iph = skb->encapsulation ?
>                                     inner_ip_hdr(skb) : ip_hdr(skb);
>
> -               if (!(iph->frag_off & htons(IP_DF)))
> +               if (!(iph->frag_off & htons(IP_DF))) {
>                         features &= ~NETIF_F_TSO_MANGLEID;

Nit : We could avoid the above line, if we always make sure
NETIF_F_TSO_MANGLEID is set in dev->mangleid_features

> +                       features &= ~dev->mangleid_features;
> +               }
>         }
>
>         /* NETIF_F_IPV6_CSUM does not support IPv6 extension headers,
> --
> 2.52.0
>