netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH v2 0/4] GSO_BY_FRAGS correctness improvements
@ 2018-03-01  6:13 Daniel Axtens
  2018-03-01  6:13 ` [PATCH v2 1/4] net: rename skb_gso_validate_mtu -> skb_gso_validate_network_len Daniel Axtens
                   ` (5 more replies)
  0 siblings, 6 replies; 12+ messages in thread
From: Daniel Axtens @ 2018-03-01  6:13 UTC (permalink / raw)
  To: netdev; +Cc: Daniel Axtens

As requested [1], I went through and had a look at users of gso_size to
see if there were things that need to be fixed to consider
GSO_BY_FRAGS, and I have tried to improve our helper functions to deal
with this case.

I found a few. This fixes bugs relating to the use of
skb_gso_*_seglen() where GSO_BY_FRAGS is not considered.

Patch 1 renames skb_gso_validate_mtu to skb_gso_validate_network_len.
This is follow-up to my earlier patch 2b16f048729b ("net: create
skb_gso_validate_mac_len()"), and just makes everything a bit clearer.

Patches 2 and 3 replace the final users of skb_gso_network_seglen() -
which doesn't consider GSO_BY_FRAGS - with
skb_gso_validate_network_len(), which does. This allows me to make the
skb_gso_*_seglen functions private in patch 4 - now future users won't
accidentally do the wrong comparison.

Two things remain. One is qdisc_pkt_len_init, which is discussed at
[2] - it's caught up in the GSO_DODGY mess. I don't have any expertise
in GSO_DODGY, and it looks like a good clean fix will involve
unpicking the whole validation mess, so I have left it for now.

Secondly, there are 3 eBPF opcodes that change the gso_size of an SKB
and don't consider GSO_BY_FRAGS. This is going through the bpf tree.

Regards,
Daniel

[1] https://patchwork.ozlabs.org/comment/1852414/
[2] https://www.spinics.net/lists/netdev/msg482397.html

PS: This is all in the core networking stack. For a driver to be
affected by this it would need to support NETIF_F_GSO_SCTP /
NETIF_F_GSO_SOFTWARE and then either use gso_size or not be a purely
virtual device. (Many drivers look at gso_size, but do not support
SCTP segmentation, so the core network will segment an SCTP gso before
it hits them.) Based on that, the only driver that may be affected is
sunvnet, but I have no way of testing it, so I haven't looked at it.

v2: split out bpf stuff
    fix review comments from Dave Miller

Daniel Axtens (4):
  net: rename skb_gso_validate_mtu -> skb_gso_validate_network_len
  net: sched: tbf: handle GSO_BY_FRAGS case in enqueue
  net: xfrm: use skb_gso_validate_network_len() to check gso sizes
  net: make skb_gso_*_seglen functions private

 include/linux/skbuff.h                  | 35 +-----------------------
 net/core/skbuff.c                       | 48 ++++++++++++++++++++++++++++-----
 net/ipv4/ip_forward.c                   |  2 +-
 net/ipv4/ip_output.c                    |  2 +-
 net/ipv4/netfilter/nf_flow_table_ipv4.c |  2 +-
 net/ipv4/xfrm4_output.c                 |  3 ++-
 net/ipv6/ip6_output.c                   |  2 +-
 net/ipv6/netfilter/nf_flow_table_ipv6.c |  2 +-
 net/ipv6/xfrm6_output.c                 |  2 +-
 net/mpls/af_mpls.c                      |  2 +-
 net/sched/sch_tbf.c                     |  3 ++-
 net/xfrm/xfrm_device.c                  |  2 +-
 12 files changed, 54 insertions(+), 51 deletions(-)

-- 
2.14.1

^ permalink raw reply	[flat|nested] 12+ messages in thread
* [PATCH v2 0/4] Check size of packets before sending
@ 2018-01-25  4:31 Daniel Axtens
  2018-01-25  4:31 ` [PATCH v2 1/4] net: rename skb_gso_validate_mtu -> skb_gso_validate_network_len Daniel Axtens
  0 siblings, 1 reply; 12+ messages in thread
From: Daniel Axtens @ 2018-01-25  4:31 UTC (permalink / raw)
  To: netdev-u79uwXL29TY76Z2rM5mHXA
  Cc: dev-yBygre7rU0TnMu66kgdUjQ, Marcelo Ricardo Leitner, Jason Wang,
	Daniel Axtens, Manish.Chopra-YGCgFSpz5w/QT0dZR+AlfA

There are a few ways we can send packets that are too large to a
network driver.

When non-GSO packets are forwarded, we validate their size, based on
the MTU of the destination device. However, when GSO packets are
forwarded, we do not validate their size. We implicitly assume that
when they are segmented, the resultant packets will be correctly
sized.

This is not always the case.

We observed a case where a packet received on an ibmveth device had a
GSO size of around 10kB. This was forwarded by Open vSwitch to a bnx2x
device, where it caused a firmware assert. This is described in detail
at [0] and was the genesis of this series.

Rather than fixing this in the driver, this series fixes the
core path. It does it in 2 steps:

 1) make is_skb_forwardable check GSO packets - this catches bridges
 
 2) make validate_xmit_skb check the size of all packets, so as to
    catch everything else (e.g. macvlan, tc mired, OVS)

I am a bit nervous about how this series will interact with nested
VLANs, as the existing code only allows for one VLAN_HLEN. (Previously
these packets would sail past unchecked.) But I thought it would be
prudent to get more eyes on this sooner rather than later.

Thanks,
Daniel

v1: https://www.spinics.net/lists/netdev/msg478634.html
Changes in v2:

 - improve names, thanks Marcelo Ricardo Leitner

 - add check to xmit_validate_skb; thanks to everyone who participated
   in the discussion.

 - drop extra check in Open vSwitch. Bad packets will be caught by
   validate_xmit_skb for now and we can come back and add it later if
   OVS people would like the extra logging.
   
[0]: https://patchwork.ozlabs.org/patch/859410/

Cc: Jason Wang <jasowang-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
Cc: Pravin Shelar <pshelar-LZ6Gd1LRuIk@public.gmane.org>
Cc: Marcelo Ricardo Leitner <marcelo.leitner-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
Cc: Manish.Chopra-YGCgFSpz5w/QT0dZR+AlfA@public.gmane.org
Cc: dev-yBygre7rU0TnMu66kgdUjQ@public.gmane.org

Daniel Axtens (4):
  net: rename skb_gso_validate_mtu -> skb_gso_validate_network_len
  net: move skb_gso_mac_seglen to skbuff.h
  net: is_skb_forwardable: check the size of GSO segments
  net: check the size of a packet in validate_xmit_skb

 include/linux/skbuff.h                  | 18 ++++++++-
 net/core/dev.c                          | 24 ++++++++----
 net/core/skbuff.c                       | 66 ++++++++++++++++++++++++++-------
 net/ipv4/ip_forward.c                   |  2 +-
 net/ipv4/ip_output.c                    |  2 +-
 net/ipv4/netfilter/nf_flow_table_ipv4.c |  2 +-
 net/ipv6/ip6_output.c                   |  2 +-
 net/ipv6/netfilter/nf_flow_table_ipv6.c |  2 +-
 net/mpls/af_mpls.c                      |  2 +-
 net/sched/sch_tbf.c                     | 10 -----
 net/xfrm/xfrm_device.c                  |  2 +-
 11 files changed, 93 insertions(+), 39 deletions(-)

-- 
2.14.1

^ permalink raw reply	[flat|nested] 12+ messages in thread
end of thread, other threads:[~2018-03-04 23:11 UTC | newest]

Thread overview: 12+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-03-01  6:13 [PATCH v2 0/4] GSO_BY_FRAGS correctness improvements Daniel Axtens
2018-03-01  6:13 ` [PATCH v2 1/4] net: rename skb_gso_validate_mtu -> skb_gso_validate_network_len Daniel Axtens
2018-03-02 21:11   ` Marcelo Ricardo Leitner
2018-03-01  6:13 ` [PATCH v2 2/4] net: sched: tbf: handle GSO_BY_FRAGS case in enqueue Daniel Axtens
2018-03-02 21:11   ` Marcelo Ricardo Leitner
2018-03-01  6:13 ` [PATCH v2 3/4] net: xfrm: use skb_gso_validate_network_len() to check gso sizes Daniel Axtens
2018-03-02 21:12   ` Marcelo Ricardo Leitner
2018-03-01  6:13 ` [PATCH v2 4/4] net: make skb_gso_*_seglen functions private Daniel Axtens
2018-03-02 21:13   ` Marcelo Ricardo Leitner
     [not found] ` <CAP-MU4PDm-5WaGorMUa4J9GVkmXPJjbyAAaUMvefEsqzFrxQWg@mail.gmail.com>
2018-03-01 20:41   ` [PATCH v2 0/4] GSO_BY_FRAGS correctness improvements Shannon Nelson
2018-03-04 23:11 ` David Miller
  -- strict thread matches above, loose matches on Subject: below --
2018-01-25  4:31 [PATCH v2 0/4] Check size of packets before sending Daniel Axtens
2018-01-25  4:31 ` [PATCH v2 1/4] net: rename skb_gso_validate_mtu -> skb_gso_validate_network_len Daniel Axtens

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).