lkml.org 
[lkml]   [2017]   [Aug]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 134/134] udp: consistently apply ufo or fragmentation
    3.16.47-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Willem de Bruijn <willemb@google.com>

    commit 85f1bd9a7b5a79d5baa8bf44af19658f7bf77bfa upstream.

    When iteratively building a UDP datagram with MSG_MORE and that
    datagram exceeds MTU, consistently choose UFO or fragmentation.

    Once skb_is_gso, always apply ufo. Conversely, once a datagram is
    split across multiple skbs, do not consider ufo.

    Sendpage already maintains the first invariant, only add the second.
    IPv6 does not have a sendpage implementation to modify.

    A gso skb must have a partial checksum, do not follow sk_no_check_tx
    in udp_send_skb.

    Found by syzkaller.

    Fixes: e89e9cf539a2 ("[IPv4/IPv6]: UFO Scatter-gather approach")
    Reported-by: Andrey Konovalov <andreyknvl@google.com>
    Signed-off-by: Willem de Bruijn <willemb@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    [bwh: Backported to 3.16:
    - ip6_append_data() doesn't take a queue parameter; use &sk->sk_write_queue
    - Adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    net/ipv4/ip_output.c | 7 +++++--
    net/ipv4/udp.c | 2 +-
    net/ipv6/ip6_output.c | 7 ++++---
    3 files changed, 10 insertions(+), 6 deletions(-)

    --- a/net/ipv4/ip_output.c
    +++ b/net/ipv4/ip_output.c
    @@ -885,10 +885,12 @@ static int __ip_append_data(struct sock
    csummode = CHECKSUM_PARTIAL;

    cork->length += length;
    - if (((length > mtu) || (skb && skb_is_gso(skb))) &&
    + if ((skb && skb_is_gso(skb)) ||
    + ((length > mtu) &&
    + (skb_queue_len(queue) <= 1) &&
    (sk->sk_protocol == IPPROTO_UDP) &&
    (rt->dst.dev->features & NETIF_F_UFO) && !dst_xfrm(&rt->dst) &&
    - (sk->sk_type == SOCK_DGRAM)) {
    + (sk->sk_type == SOCK_DGRAM))) {
    err = ip_ufo_append_data(sk, queue, getfrag, from, length,
    hh_len, fragheaderlen, transhdrlen,
    maxfraglen, flags);
    @@ -1203,6 +1205,7 @@ ssize_t ip_append_page(struct sock *sk,

    cork->length += size;
    if ((size + skb->len > mtu) &&
    + (skb_queue_len(&sk->sk_write_queue) == 1) &&
    (sk->sk_protocol == IPPROTO_UDP) &&
    (rt->dst.dev->features & NETIF_F_UFO)) {
    skb_shinfo(skb)->gso_size = mtu - fragheaderlen;
    --- a/net/ipv4/udp.c
    +++ b/net/ipv4/udp.c
    @@ -824,7 +824,7 @@ static int udp_send_skb(struct sk_buff *
    if (is_udplite) /* UDP-Lite */
    csum = udplite_csum(skb);

    - else if (sk->sk_no_check_tx) { /* UDP csum disabled */
    + else if (sk->sk_no_check_tx && !skb_is_gso(skb)) { /* UDP csum off */

    skb->ip_summed = CHECKSUM_NONE;
    goto send;
    --- a/net/ipv6/ip6_output.c
    +++ b/net/ipv6/ip6_output.c
    @@ -1291,11 +1291,12 @@ emsgsize:

    skb = skb_peek_tail(&sk->sk_write_queue);
    cork->length += length;
    - if ((((length + fragheaderlen) > mtu) ||
    - (skb && skb_is_gso(skb))) &&
    + if ((skb && skb_is_gso(skb)) ||
    + (((length + fragheaderlen) > mtu) &&
    + (skb_queue_len(&sk->sk_write_queue) <= 1) &&
    (sk->sk_protocol == IPPROTO_UDP) &&
    (rt->dst.dev->features & NETIF_F_UFO) && !dst_xfrm(&rt->dst) &&
    - (sk->sk_type == SOCK_DGRAM)) {
    + (sk->sk_type == SOCK_DGRAM))) {
    err = ip6_ufo_append_data(sk, getfrag, from, length,
    hh_len, fragheaderlen, exthdrlen,
    transhdrlen, mtu, flags, rt);
    \
     
     \ /
      Last update: 2017-08-18 15:25    [W:4.306 / U:1.332 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site