[PATCH net-next 0/2] net: Fix "hw csum failure" message flood for ppp tunnel

[PATCH net-next 0/2] net: Fix "hw csum failure" message flood for ppp tunnel

[Tom Herbert]

This patch set addresses bug "Bug 95171 - "hw csum failure" message
flood for ppp tunnel since upgrade to 3.16". The problem is that pppoe
is being used over UDP with UDP checksusm enabled. On receive
checksum conversion turns checksum-unnecessary in checksum-
complete. The PPP receive functions do no properly pull
the checksum over its headers, so that when an encapsulated
checksums is considered the checksum-complete value is incorrect.

This patch adds skb_checksum_complete_unset which can be called
in the receive path in lieu of pulling checksum complete in
layer. This is useful when the packet is being modified (e.g.
decompressed) and the checksum-complete value is no longer
relevant.

In the ppp_receive_frame we call skb_checksum_complete_unset to toss
out checksum-complete. This should eliminate the reported messages.
Alternatively, we could add skb_postpull_rcsum and probably
special case handling for VJ compression if maintaining the
checksum-complete is needed (not clear to me this is worth the
effort).

I haven't tested this since setting up the failure scenario doesn't
seem trivial to configure.
Tom Herbert (2):
  net: add skb_checksum_complete_unset
  ppp: call skb_checksum_complete_unset in ppp_receive_frame

 drivers/net/ppp/ppp_generic.c |  1 +
 include/linux/skbuff.h        | 12 ++++++++++++
 2 files changed, 13 insertions(+)

-- 
1.8.1

[PATCH net-next 1/2] net: add skb_checksum_complete_unset

[Tom Herbert]

This function changes ip_summed to CHECKSUM_NONE if CHECKSUM_COMPLETE
is set. This is called to discard checksum-complete when packet
is being modified and checksum is not pulled for headers in a layer.

Signed-off-by: Tom Herbert <tom@herbertland.com>
---
 include/linux/skbuff.h | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 0991259..06793b5 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -3016,6 +3016,18 @@ static inline bool __skb_checksum_validate_needed(struct sk_buff *skb,
  */
 #define CHECKSUM_BREAK 76
 
+/* Unset checksum-complete
+ *
+ * Unset checksum complete can be done when packet is being modified
+ * (uncompressed for instance) and checksum-complete value is
+ * invalidated.
+ */
+static inline void skb_checksum_complete_unset(struct sk_buff *skb)
+{
+	if (skb->ip_summed == CHECKSUM_COMPLETE)
+		skb->ip_summed = CHECKSUM_NONE;
+}
+
 /* Validate (init) checksum based on checksum complete.
  *
  * Return values:
-- 
1.8.1

[PATCH net-next 2/2] ppp: call skb_checksum_complete_unset in ppp_receive_frame

[Tom Herbert]

Call checksum_complete_unset in PPP receive to discard checksum-complete
value. PPP does not pull checksum for headers and also modifies packet
as in VJ compression.

Signed-off-by: Tom Herbert <tom@herbertland.com>
---
 drivers/net/ppp/ppp_generic.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index af034db..9d15566 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -1716,6 +1716,7 @@ ppp_receive_frame(struct ppp *ppp, struct sk_buff *skb, struct channel *pch)
 {
 	/* note: a 0-length skb is used as an error indication */
 	if (skb->len > 0) {
+		skb_checksum_complete_unset(skb);
 #ifdef CONFIG_PPP_MULTILINK
 		/* XXX do channel-level decompression here */
 		if (PPP_PROTO(skb) == PPP_MP)
-- 
1.8.1

Re: [PATCH net-next 0/2] net: Fix "hw csum failure" message flood for ppp tunnel

[David Miller]

From: Tom Herbert <tom@herbertland.com>
Date: Mon, 20 Apr 2015 14:10:03 -0700

> This patch set addresses bug "Bug 95171 - "hw csum failure" message
> flood for ppp tunnel since upgrade to 3.16". The problem is that pppoe
> is being used over UDP with UDP checksusm enabled. On receive
> checksum conversion turns checksum-unnecessary in checksum-
> complete. The PPP receive functions do no properly pull
> the checksum over its headers, so that when an encapsulated
> checksums is considered the checksum-complete value is incorrect.
> 
> This patch adds skb_checksum_complete_unset which can be called
> in the receive path in lieu of pulling checksum complete in
> layer. This is useful when the packet is being modified (e.g.
> decompressed) and the checksum-complete value is no longer
> relevant.
> 
> In the ppp_receive_frame we call skb_checksum_complete_unset to toss
> out checksum-complete. This should eliminate the reported messages.
> Alternatively, we could add skb_postpull_rcsum and probably
> special case handling for VJ compression if maintaining the
> checksum-complete is needed (not clear to me this is worth the
> effort).
> 
> I haven't tested this since setting up the failure scenario doesn't
> seem trivial to configure.

I'm preemptively applying this, but it's really important for
folks to give this some good testing.

Thanks Tom.