Re: [PATCH net] net: prevent pulling SKB_GSO_FRAGLIST skb

["Lena Wang (王娜)" <Lena.Wang@mediatek.com>]

On Mon, 2024-04-29 at 06:42 -0700, Jakub Kicinski wrote:
>  	 
> External email : Please do not click links or open attachments until
> you have verified the sender or the content.
>  On Sun, 28 Apr 2024 22:29:13 +0800 shiming.cheng@mediatek.com wrote:
> > From: Shiming Cheng <shiming.cheng@mediatek.com>
> > 
> > BPF or TC callers may pull in a length longer than skb_headlen()
> > for a SKB_GSO_FRAGLIST skb. The data in fraglist will be pulled
> > into the linear space. However it destroys the skb's structure
> > and may result in an invalid segmentation or kernel exception.
> > 
> > So we should add protection to stop the operation and return
> > error to remind callers.
> 
> One of the fixes you posted breaks the
> 
>   tools/testing/selftests/net/udpgro_fwd.sh
> 
> selftest. Please investigate, and either adjust the test or the fix.

Dear Jakub,
Sorry for late response.
As we do not make selftest before, I try to build a test environmen and
cost time to apply sudo access right in our company server. Now it
blocks to generate xdp_dummy.bpf.o. Could you please give some guidline
about the script test step? Thanks.

Could you give more info about the failed situation?  
Is it this fix "[PATCH net] net: prevent pulling SKB_GSO_FRAGLIST skb"
failed?
Which case is failed?
Is it possible that the test case has issue?


>  {
> > +if (skb_is_gso(skb) &&
> > +    (skb_shinfo(skb)->gso_type & SKB_GSO_FRAGLIST) &&
> > +     write_len > skb_headlen(skb)) {
> > +return -ENOMEM;
> > +}
> > +
> 
> Most callers of skb_ensure_writable pull less than headlen.
> It might be good to start with the write_len check. Before
> looking at gso type.
> 

Dear Willem,
I will udpate as your advice in v2 as:
+if (write_len > skb_headlen(skb) && skb_is_gso(skb) &&
+    (skb_shinfo
(skb)->gso_type & SKB_GSO_FRAGLIST)) {

About selftests/net/udpgro_fwd.sh case failed, do you know the reason
or have any advice?

Thanks
Lena