| Message ID | 20220505054850.4878-1-lina.wang@mediatek.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | cf3ab8d4a797960b4be20565abb3bcd227b18a68 |
| Headers | show |
| Series | [v6,1/2] net: fix wrong network header length | expand |
Hello: This series was applied to netdev/net.git (master) by David S. Miller <davem@davemloft.net>: On Thu, 5 May 2022 13:48:49 +0800 you wrote: > When clatd starts with ebpf offloaing, and NETIF_F_GRO_FRAGLIST is enable, > several skbs are gathered in skb_shinfo(skb)->frag_list. The first skb's > ipv6 header will be changed to ipv4 after bpf_skb_proto_6_to_4, > network_header\transport_header\mac_header have been updated as ipv4 acts, > but other skbs in frag_list didnot update anything, just ipv6 packets. > > udp_queue_rcv_skb will call skb_segment_list to traverse other skbs in > frag_list and make sure right udp payload is delivered to user space. > Unfortunately, other skbs in frag_list who are still ipv6 packets are > updated like the first skb and will have wrong transport header length. > > [...] Here is the summary with links: - [v6,1/2] net: fix wrong network header length https://git.kernel.org/netdev/net/c/cf3ab8d4a797 - [v6,2/2] selftests net: add UDP GRO fraglist + bpf self-tests (no matching commit) You are awesome, thank you!
diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 10bde7c6db44..e8006e0a1b25 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -3897,7 +3897,7 @@ struct sk_buff *skb_segment_list(struct sk_buff *skb, unsigned int delta_len = 0; struct sk_buff *tail = NULL; struct sk_buff *nskb, *tmp; - int err; + int len_diff, err; skb_push(skb, -skb_network_offset(skb) + offset); @@ -3937,9 +3937,11 @@ struct sk_buff *skb_segment_list(struct sk_buff *skb, skb_push(nskb, -skb_network_offset(nskb) + offset); skb_release_head_state(nskb); + len_diff = skb_network_header_len(nskb) - skb_network_header_len(skb); __copy_skb_header(nskb, skb); skb_headers_offset_update(nskb, skb_headroom(nskb) - skb_headroom(skb)); + nskb->transport_header += len_diff; skb_copy_from_linear_data_offset(skb, -tnl_hlen, nskb->data - tnl_hlen, offset + tnl_hlen);
When clatd starts with ebpf offloaing, and NETIF_F_GRO_FRAGLIST is enable, several skbs are gathered in skb_shinfo(skb)->frag_list. The first skb's ipv6 header will be changed to ipv4 after bpf_skb_proto_6_to_4, network_header\transport_header\mac_header have been updated as ipv4 acts, but other skbs in frag_list didnot update anything, just ipv6 packets. udp_queue_rcv_skb will call skb_segment_list to traverse other skbs in frag_list and make sure right udp payload is delivered to user space. Unfortunately, other skbs in frag_list who are still ipv6 packets are updated like the first skb and will have wrong transport header length. e.g.before bpf_skb_proto_6_to_4,the first skb and other skbs in frag_list has the same network_header(24)& transport_header(64), after bpf_skb_proto_6_to_4, ipv6 protocol has been changed to ipv4, the first skb's network_header is 44,transport_header is 64, other skbs in frag_list didnot change.After skb_segment_list, the other skbs in frag_list has different network_header(24) and transport_header(44), so there will be 20 bytes different from original,that is difference between ipv6 header and ipv4 header. Just change transport_header to be the same with original. Actually, there are two solutions to fix it, one is traversing all skbs and changing every skb header in bpf_skb_proto_6_to_4, the other is modifying frag_list skb's header in skb_segment_list. Considering efficiency, adopt the second one--- when the first skb and other skbs in frag_list has different network_header length, restore them to make sure right udp payload is delivered to user space. Signed-off-by: Lina Wang <lina.wang@mediatek.com> --- net/core/skbuff.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)