From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Andrey Konovalov <andreyknvl@google.com>,
Willem de Bruijn <willemb@google.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 4.4 10/15] udp: consistently apply ufo or fragmentation
Date: Fri, 11 Aug 2017 15:02:24 -0700 [thread overview]
Message-ID: <20170811220219.861708986@linuxfoundation.org> (raw)
In-Reply-To: <20170811220219.438083791@linuxfoundation.org>
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Willem de Bruijn <willemb@google.com>
[ Upstream commit 85f1bd9a7b5a79d5baa8bf44af19658f7bf77bfa ]
When iteratively building a UDP datagram with MSG_MORE and that
datagram exceeds MTU, consistently choose UFO or fragmentation.
Once skb_is_gso, always apply ufo. Conversely, once a datagram is
split across multiple skbs, do not consider ufo.
Sendpage already maintains the first invariant, only add the second.
IPv6 does not have a sendpage implementation to modify.
A gso skb must have a partial checksum, do not follow sk_no_check_tx
in udp_send_skb.
Found by syzkaller.
Fixes: e89e9cf539a2 ("[IPv4/IPv6]: UFO Scatter-gather approach")
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/ip_output.c | 7 +++++--
net/ipv4/udp.c | 2 +-
net/ipv6/ip6_output.c | 7 ++++---
3 files changed, 10 insertions(+), 6 deletions(-)
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -922,10 +922,12 @@ static int __ip_append_data(struct sock
csummode = CHECKSUM_PARTIAL;
cork->length += length;
- if (((length > mtu) || (skb && skb_is_gso(skb))) &&
+ if ((skb && skb_is_gso(skb)) ||
+ ((length > mtu) &&
+ (skb_queue_len(queue) <= 1) &&
(sk->sk_protocol == IPPROTO_UDP) &&
(rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len &&
- (sk->sk_type == SOCK_DGRAM) && !sk->sk_no_check_tx) {
+ (sk->sk_type == SOCK_DGRAM) && !sk->sk_no_check_tx)) {
err = ip_ufo_append_data(sk, queue, getfrag, from, length,
hh_len, fragheaderlen, transhdrlen,
maxfraglen, flags);
@@ -1241,6 +1243,7 @@ ssize_t ip_append_page(struct sock *sk,
return -EINVAL;
if ((size + skb->len > mtu) &&
+ (skb_queue_len(&sk->sk_write_queue) == 1) &&
(sk->sk_protocol == IPPROTO_UDP) &&
(rt->dst.dev->features & NETIF_F_UFO)) {
if (skb->ip_summed != CHECKSUM_PARTIAL)
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -819,7 +819,7 @@ static int udp_send_skb(struct sk_buff *
if (is_udplite) /* UDP-Lite */
csum = udplite_csum(skb);
- else if (sk->sk_no_check_tx) { /* UDP csum disabled */
+ else if (sk->sk_no_check_tx && !skb_is_gso(skb)) { /* UDP csum off */
skb->ip_summed = CHECKSUM_NONE;
goto send;
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1357,11 +1357,12 @@ emsgsize:
*/
cork->length += length;
- if ((((length + fragheaderlen) > mtu) ||
- (skb && skb_is_gso(skb))) &&
+ if ((skb && skb_is_gso(skb)) ||
+ (((length + fragheaderlen) > mtu) &&
+ (skb_queue_len(queue) <= 1) &&
(sk->sk_protocol == IPPROTO_UDP) &&
(rt->dst.dev->features & NETIF_F_UFO) &&
- (sk->sk_type == SOCK_DGRAM) && !udp_get_no_check6_tx(sk)) {
+ (sk->sk_type == SOCK_DGRAM) && !udp_get_no_check6_tx(sk))) {
err = ip6_ufo_append_data(sk, queue, getfrag, from, length,
hh_len, fragheaderlen, exthdrlen,
transhdrlen, mtu, flags, fl6);
next prev parent reply other threads:[~2017-08-11 22:02 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-08-11 22:02 [PATCH 4.4 00/15] 4.4.82-stable review Greg Kroah-Hartman
2017-08-11 22:02 ` [PATCH 4.4 01/15] tcp: avoid setting cwnd to invalid ssthresh after cwnd reduction states Greg Kroah-Hartman
2017-08-11 22:02 ` [PATCH 4.4 02/15] net: fix keepalive code vs TCP_FASTOPEN_CONNECT Greg Kroah-Hartman
2017-08-18 11:57 ` Eddie Chapman
2017-08-11 22:02 ` [PATCH 4.4 03/15] bpf, s390: fix jit branch offset related to ldimm64 Greg Kroah-Hartman
2017-08-11 22:02 ` [PATCH 4.4 04/15] net: sched: set xt_tgchk_param par.nft_compat as 0 in ipt_init_target Greg Kroah-Hartman
2017-08-11 22:02 ` [PATCH 4.4 05/15] tcp: fastopen: tcp_connect() must refresh the route Greg Kroah-Hartman
2017-08-11 22:02 ` [PATCH 4.4 06/15] net: avoid skb_warn_bad_offload false positives on UFO Greg Kroah-Hartman
2017-08-11 22:02 ` [PATCH 4.4 07/15] packet: fix tp_reserve race in packet_set_ring Greg Kroah-Hartman
2017-08-11 22:02 ` [PATCH 4.4 08/15] revert "net: account for current skb length when deciding about UFO" Greg Kroah-Hartman
2017-08-11 22:02 ` [PATCH 4.4 09/15] revert "ipv4: Should use consistent conditional judgement for ip fragment in __ip_append_data and ip_finish_output" Greg Kroah-Hartman
2017-08-11 22:02 ` Greg Kroah-Hartman [this message]
2017-08-11 22:02 ` [PATCH 4.4 11/15] sparc64: Prevent perf from running during super critical sections Greg Kroah-Hartman
2017-08-11 22:02 ` [PATCH 4.4 12/15] KVM: arm/arm64: Handle hva aging while destroying the vm Greg Kroah-Hartman
2017-08-11 22:02 ` [PATCH 4.4 13/15] mm/mempool: avoid KASAN marking mempool poison checks as use-after-free Greg Kroah-Hartman
2017-08-11 22:02 ` [PATCH 4.4 14/15] ipv4: Should use consistent conditional judgement for ip fragment in __ip_append_data and ip_finish_output Greg Kroah-Hartman
2017-08-12 1:57 ` [PATCH 4.4 00/15] 4.4.82-stable review Shuah Khan
2017-08-12 12:24 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170811220219.861708986@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=andreyknvl@google.com \
--cc=davem@davemloft.net \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=willemb@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).