From mboxrd@z Thu Jan 1 00:00:00 1970 From: =?UTF-8?B?67Cw7ISd7KeE?= Subject: [Kernel][NET] Bug report on packet defragmenting Date: Thu, 08 Nov 2018 10:29:27 +0900 Message-ID: <20181108012927epcms1p47f719c1908da64a378690362901644ee@epcms1p4> References: Reply-To: soukjin.bae@samsung.com Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit To: "netdev@vger.kernel.org" Return-path: Received: from mailout4.samsung.com ([203.254.224.34]:38764 "EHLO mailout4.samsung.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728256AbeKHLCd (ORCPT ); Thu, 8 Nov 2018 06:02:33 -0500 Received: from epcas1p3.samsung.com (unknown [182.195.41.47]) by mailout4.samsung.com (KnoxPortal) with ESMTP id 20181108012930epoutp0430af144bfad0af774fcea0fb5ce9ca28~lAe5QutPR1021410214epoutp04B for ; Thu, 8 Nov 2018 01:29:30 +0000 (GMT) Sender: netdev-owner@vger.kernel.org List-ID: Hello, This is bae working on Samsung Elec. We got the problem that fragmented SIP packet couldn't be deliverd to user layer. And found that they were stoled at HOOK function, ipv6_defrag. In condition with SMP and RPS. After first fragmented packet, they have no further network header except ip. But __skb_flow_dissect function using the port field to determine hash key, 'ports'. So each packet get different hash key, and be sent to different core. Although hash is different, selected cpu could be same. but it just lucky. [exam 2] And addition, when those packets arrived with little time gap. They became ran the ipv6_defrag hook simultaneously in each core. So they each be treated to first fragmented packet. And they can't merged to original packet, and can't be deliverd to upper. [exam 1] If ipv6_defrag hook is not excuted simultaneously, then it's ok. ipv6_defrag hook can handle that. [exam 3] We'll skip 'ports' setting when the packet was fragmented. Because of IPv6 SIP invite packet is usally fragmented, this problem is very often. >>From be74b56861cf76a16d0f2d054d468c584ed67cce Mon Sep 17 00:00:00 2001 From: soukjin bae Date: Thu, 8 Nov 2018 09:52:29 +0900 Subject: [PATCH] flow_dissector: don't refer port field in fragmented packet After first fragmented packet, they have no further network header except ip. So when try to refer port field in nexthdr, they got the garbage from payload. Skip port set when the packet was fragmented. Signed-off-by: soukjin bae --- net/core/flow_dissector.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c index 676f3ad629f9..928df25129ba 100644 --- a/net/core/flow_dissector.c +++ b/net/core/flow_dissector.c @@ -1166,8 +1166,8 @@ bool __skb_flow_dissect(const struct sk_buff *skb, break; } - if (dissector_uses_key(flow_dissector, - FLOW_DISSECTOR_KEY_PORTS)) { + if (dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_PORTS) + && !(key_control->flags & FLOW_DIS_IS_FRAGMENT)) { key_ports = skb_flow_dissector_target(flow_dissector, FLOW_DISSECTOR_KEY_PORTS, target_container); -- 2.13.0 [exam 1] # tcp dump #