[PATCHv2] net: fix bridge multicast packet checksum validation

[PATCHv2] net: fix bridge multicast packet checksum validation

[Linus Lüssing]

We need to update the skb->csum after pulling the skb, otherwise
an unnecessary checksum (re)computation can ocure for IGMP/MLD packets
in the bridge code. Additionally this fixes the following splats for
network devices / bridge ports with support for and enabled RX checksum
offloading:

[...]
[   43.986968] eth0: hw csum failure
[   43.990344] CPU: 3 PID: 0 Comm: swapper/3 Not tainted 4.4.0 #2
[   43.996193] Hardware name: BCM2709
[   43.999647] [<800204e0>] (unwind_backtrace) from [<8001cf14>] (show_stack+0x10/0x14)
[   44.007432] [<8001cf14>] (show_stack) from [<801ab614>] (dump_stack+0x80/0x90)
[   44.014695] [<801ab614>] (dump_stack) from [<802e4548>] (__skb_checksum_complete+0x6c/0xac)
[   44.023090] [<802e4548>] (__skb_checksum_complete) from [<803a055c>] (ipv6_mc_validate_checksum+0x104/0x178)
[   44.032959] [<803a055c>] (ipv6_mc_validate_checksum) from [<802e111c>] (skb_checksum_trimmed+0x130/0x188)
[   44.042565] [<802e111c>] (skb_checksum_trimmed) from [<803a06e8>] (ipv6_mc_check_mld+0x118/0x338)
[   44.051501] [<803a06e8>] (ipv6_mc_check_mld) from [<803b2c98>] (br_multicast_rcv+0x5dc/0xd00)
[   44.060077] [<803b2c98>] (br_multicast_rcv) from [<803aa510>] (br_handle_frame_finish+0xac/0x51c)
[...]

Fixes: 9afd85c9e455 ("net: Export IGMP/MLD message validation code")
Reported-by: Álvaro Fernández Rojas <noltari@gmail.com>
Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
---

v2:
* substituted the storing of the csum with an skb_push_rcsum() approach
 (did some more reading about CHECKSUM_PARTIAL, and it seems to me that the
  skb_push direction is actually the easier/"safer" one, so there should be
  no resetting to CHECKSUM_NONE necessary)
* Rewording of commit message, this bug should not cause any packet loss
  due to "automatic" checksum recomputations in software if skb->csum
  is bogus (in the CHECKSUM_COMPLETE case)

 include/linux/skbuff.h |   17 +++++++++++++++++
 net/core/skbuff.c      |   22 ++++++++++++++++++++--
 2 files changed, 37 insertions(+), 2 deletions(-)

diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 4ce9ff7..d66e007 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -2784,6 +2784,23 @@ static inline int skb_linearize_cow(struct sk_buff *skb)
 }
 
 /**
+ *	skb_postpush_rcsum - update checksum for received skb after push
+ *	@skb: buffer to update
+ *	@start: start of data before push
+ *	@len: length of data pushed
+ *
+ *	After doing a push on a received packet, you need to call this to
+ *	update the CHECKSUM_COMPLETE checksum.
+ */
+
+static inline void skb_postpush_rcsum(struct sk_buff *skb,
+				      const void *start, unsigned int len)
+{
+	if (skb->ip_summed == CHECKSUM_COMPLETE)
+		skb->csum = csum_add(skb->csum, csum_partial(start, len, 0));
+}
+
+/**
  *	skb_postpull_rcsum - update checksum for received skb after pull
  *	@skb: buffer to update
  *	@start: start of data before pull
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 5bf88f5..8616d11 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2948,6 +2948,24 @@ int skb_append_pagefrags(struct sk_buff *skb, struct page *page,
 EXPORT_SYMBOL_GPL(skb_append_pagefrags);
 
 /**
+ *	skb_push_rcsum - push skb and update receive checksum
+ *	@skb: buffer to update
+ *	@len: length of data pulled
+ *
+ *	This function performs an skb_push on the packet and updates
+ *	the CHECKSUM_COMPLETE checksum.  It should be used on
+ *	receive path processing instead of skb_push unless you know
+ *	that the checksum difference is zero (e.g., a valid IP header)
+ *	or you are setting ip_summed to CHECKSUM_NONE.
+ */
+static unsigned char *skb_push_rcsum(struct sk_buff *skb, unsigned len)
+{
+	skb_push(skb, len);
+	skb_postpush_rcsum(skb, skb->data, len);
+	return skb->data;
+}
+
+/**
  *	skb_pull_rcsum - pull skb and update receive checksum
  *	@skb: buffer to update
  *	@len: length of data pulled
@@ -4084,9 +4102,9 @@ struct sk_buff *skb_checksum_trimmed(struct sk_buff *skb,
 	if (!pskb_may_pull(skb_chk, offset))
 		goto err;
 
-	__skb_pull(skb_chk, offset);
+	skb_pull_rcsum(skb_chk, offset);
 	ret = skb_chkf(skb_chk);
-	__skb_push(skb_chk, offset);
+	skb_push_rcsum(skb_chk, offset);
 
 	if (ret)
 		goto err;
-- 
1.7.10.4

Re: [PATCHv2] net: fix bridge multicast packet checksum validation

[kbuild test robot]

[-- Attachment #1: Type: text/plain, Size: 2303 bytes --]

Hi Linus,

[auto build test ERROR on net/master]
[also build test ERROR on v4.5-rc5 next-20160223]
[if your patch is applied to the wrong git tree, please drop us a note to help improving the system]

url:    https://github.com/0day-ci/linux/commits/Linus-L-ssing/net-fix-bridge-multicast-packet-checksum-validation/20160224-091615
config: i386-randconfig-x004-201608 (attached as .config)
reproduce:
        # save the attached .config to linux build tree
        make ARCH=i386 

All errors (new ones prefixed by >>):

   In file included from include/linux/ip.h:20:0,
                    from include/net/ip.h:26,
                    from include/linux/errqueue.h:5,
                    from net/core/sock.c:96:
>> include/linux/skbuff.h:2826:20: error: redefinition of 'skb_postpush_rcsum'
    static inline void skb_postpush_rcsum(struct sk_buff *skb,
                       ^
   include/linux/skbuff.h:2796:20: note: previous definition of 'skb_postpush_rcsum' was here
    static inline void skb_postpush_rcsum(struct sk_buff *skb,
                       ^

vim +/skb_postpush_rcsum +2826 include/linux/skbuff.h

31b33dfb Pravin B Shelar 2015-09-28  2820  		 skb_checksum_start_offset(skb) < 0)
6ae459bd Pravin B Shelar 2015-09-22  2821  		skb->ip_summed = CHECKSUM_NONE;
^1da177e Linus Torvalds  2005-04-16  2822  }
^1da177e Linus Torvalds  2005-04-16  2823  
cbb042f9 Herbert Xu      2006-03-20  2824  unsigned char *skb_pull_rcsum(struct sk_buff *skb, unsigned int len);
cbb042f9 Herbert Xu      2006-03-20  2825  
f8ffad69 Daniel Borkmann 2016-01-07 @2826  static inline void skb_postpush_rcsum(struct sk_buff *skb,
f8ffad69 Daniel Borkmann 2016-01-07  2827  				      const void *start, unsigned int len)
f8ffad69 Daniel Borkmann 2016-01-07  2828  {
f8ffad69 Daniel Borkmann 2016-01-07  2829  	/* For performing the reverse operation to skb_postpull_rcsum(),

:::::: The code at line 2826 was first introduced by commit
:::::: f8ffad69c9f8b8dfb0b633425d4ef4d2493ba61a bpf: add skb_postpush_rcsum and fix dev_forward_skb occasions

:::::: TO: Daniel Borkmann <daniel@iogearbox.net>
:::::: CC: David S. Miller <davem@davemloft.net>

---
0-DAY kernel test infrastructure                Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all                   Intel Corporation

[-- Attachment #2: .config.gz --]
[-- Type: application/octet-stream, Size: 26750 bytes --]