linux-toradex.git/net/ipv6/ip6_offload.c, branch v4.10

gro: Disable frag0 optimization on IPv6 ext headers

2017-01-11T02:30:33+00:00

The GRO fast path caches the frag0 address.  This address becomes
invalid if frag0 is modified by pskb_may_pull or its variants.
So whenever that happens we must disable the frag0 optimization.

This is usually done through the combination of gro_header_hard
and gro_header_slow, however, the IPv6 extension header path did
the pulling directly and would continue to use the GRO fast path
incorrectly.

This patch fixes it by disabling the fast path when we enter the
IPv6 extension header path.

Fixes: 78a478d0efd9 ("gro: Inline skb_gro_header and cache frag0 virtual address")
Reported-by: Slava Shwartsman 
Signed-off-by: Herbert Xu 
Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

ip6_offload: check segs for NULL in ipv6_gso_segment.

2016-12-02T18:34:58+00:00

segs needs to be checked for being NULL in ipv6_gso_segment() before calling
skb_shinfo(segs), otherwise kernel can run into a NULL-pointer dereference:

[   97.811262] BUG: unable to handle kernel NULL pointer dereference at 00000000000000cc
[   97.819112] IP: [] ipv6_gso_segment+0x119/0x2f0
[   97.825214] PGD 0 [   97.827047]
[   97.828540] Oops: 0000 [#1] SMP
[   97.831678] Modules linked in: vhost_net vhost macvtap macvlan nfsv3 rpcsec_gss_krb5
nfsv4 dns_resolver nfs fscache xt_CHECKSUM iptable_mangle ipt_MASQUERADE nf_nat_masquerade_ipv4
iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack
ipt_REJECT nf_reject_ipv4 tun ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter
bridge stp llc snd_hda_codec_realtek snd_hda_codec_hdmi snd_hda_codec_generic snd_hda_intel
snd_hda_codec edac_mce_amd snd_hda_core edac_core snd_hwdep kvm_amd snd_seq kvm snd_seq_device
snd_pcm irqbypass snd_timer ppdev parport_serial snd parport_pc k10temp pcspkr soundcore parport
sp5100_tco shpchp sg wmi i2c_piix4 acpi_cpufreq nfsd auth_rpcgss nfs_acl lockd grace sunrpc
ip_tables xfs libcrc32c sr_mod cdrom sd_mod ata_generic pata_acpi amdkfd amd_iommu_v2 radeon
broadcom bcm_phy_lib i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops
ttm ahci serio_raw tg3 firewire_ohci libahci pata_atiixp drm ptp libata firewire_core pps_core
i2c_core crc_itu_t fjes dm_mirror dm_region_hash dm_log dm_mod
[   97.927721] CPU: 1 PID: 3504 Comm: vhost-3495 Not tainted 4.9.0-7.el7.test.x86_64 #1
[   97.935457] Hardware name: AMD Snook/Snook, BIOS ESK0726A 07/26/2010
[   97.941806] task: ffff880129a1c080 task.stack: ffffc90001bcc000
[   97.947720] RIP: 0010:[]  [] ipv6_gso_segment+0x119/0x2f0
[   97.956251] RSP: 0018:ffff88012fc43a10  EFLAGS: 00010207
[   97.961557] RAX: 0000000000000000 RBX: ffff8801292c8700 RCX: 0000000000000594
[   97.968687] RDX: 0000000000000593 RSI: ffff880129a846c0 RDI: 0000000000240000
[   97.975814] RBP: ffff88012fc43a68 R08: ffff880129a8404e R09: 0000000000000000
[   97.982942] R10: 0000000000000000 R11: ffff880129a84076 R12: 00000020002949b3
[   97.990070] R13: ffff88012a580000 R14: 0000000000000000 R15: ffff88012a580000
[   97.997198] FS:  0000000000000000(0000) GS:ffff88012fc40000(0000) knlGS:0000000000000000
[   98.005280] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   98.011021] CR2: 00000000000000cc CR3: 0000000126c5d000 CR4: 00000000000006e0
[   98.018149] Stack:
[   98.020157]  00000000ffffffff ffff88012fc43ac8 ffffffffa017ad0a 000000000000000e
[   98.027584]  0000001300000000 0000000077d59998 ffff8801292c8700 00000020002949b3
[   98.035010]  ffff88012a580000 0000000000000000 ffff88012a580000 ffff88012fc43a98
[   98.042437] Call Trace:
[   98.044879]   [   98.046803]  [] ? tg3_start_xmit+0x84a/0xd60 [tg3]
[   98.053156]  [] skb_mac_gso_segment+0xb0/0x130
[   98.059158]  [] __skb_gso_segment+0x73/0x110
[   98.064985]  [] validate_xmit_skb+0x12d/0x2b0
[   98.070899]  [] validate_xmit_skb_list+0x42/0x70
[   98.077073]  [] sch_direct_xmit+0xd0/0x1b0
[   98.082726]  [] __dev_queue_xmit+0x486/0x690
[   98.088554]  [] ? cpumask_next_and+0x35/0x50
[   98.094380]  [] dev_queue_xmit+0x10/0x20
[   98.099863]  [] br_dev_queue_push_xmit+0xa7/0x170 [bridge]
[   98.106907]  [] br_forward_finish+0x41/0xc0 [bridge]
[   98.113430]  [] ? nf_iterate+0x52/0x60
[   98.118735]  [] ? nf_hook_slow+0x6b/0xc0
[   98.124216]  [] __br_forward+0x14c/0x1e0 [bridge]
[   98.130480]  [] ? br_dev_queue_push_xmit+0x170/0x170 [bridge]
[   98.137785]  [] br_forward+0x9d/0xb0 [bridge]
[   98.143701]  [] br_handle_frame_finish+0x267/0x560 [bridge]
[   98.150834]  [] br_handle_frame+0x174/0x2f0 [bridge]
[   98.157355]  [] ? sched_clock+0x9/0x10
[   98.162662]  [] ? sched_clock_cpu+0x72/0xa0
[   98.168403]  [] __netif_receive_skb_core+0x1e5/0xa20
[   98.174926]  [] ? timerqueue_add+0x59/0xb0
[   98.180580]  [] __netif_receive_skb+0x18/0x60
[   98.186494]  [] process_backlog+0x95/0x140
[   98.192145]  [] net_rx_action+0x16d/0x380
[   98.197713]  [] __do_softirq+0xd1/0x283
[   98.203106]  [] do_softirq_own_stack+0x1c/0x30
[   98.209107]   [   98.211029]  [] do_softirq+0x50/0x60
[   98.216166]  [] netif_rx_ni+0x33/0x80
[   98.221386]  [] tun_get_user+0x487/0x7f0 [tun]
[   98.227388]  [] tun_sendmsg+0x4b/0x60 [tun]
[   98.233129]  [] handle_tx+0x282/0x540 [vhost_net]
[   98.239392]  [] handle_tx_kick+0x15/0x20 [vhost_net]
[   98.245916]  [] vhost_worker+0x9e/0xf0 [vhost]
[   98.251919]  [] ? vhost_umem_alloc+0x40/0x40 [vhost]
[   98.258440]  [] ? do_syscall_64+0x67/0x180
[   98.264094]  [] kthread+0xd9/0xf0
[   98.268965]  [] ? kthread_park+0x60/0x60
[   98.274444]  [] ret_from_fork+0x25/0x30
[   98.279836] Code: 8b 93 d8 00 00 00 48 2b 93 d0 00 00 00 4c 89 e6 48 89 df 66 89 93 c2 00 00 00 ff 10 48 3d 00 f0 ff ff 49 89 c2 0f 87 52 01 00 00 <41> 8b 92 cc 00 00 00 48 8b 80 d0 00 00 00 44 0f b7 74 10 06 66
[   98.299425] RIP  [] ipv6_gso_segment+0x119/0x2f0
[   98.305612]  RSP 
[   98.309094] CR2: 00000000000000cc
[   98.312406] ---[ end trace 726a2c7a2d2d78d0 ]---

Signed-off-by: Artem Savkov 
Acked-by: Eric Dumazet 
Signed-off-by: David S. Miller

net: add recursion limit to GRO

2016-10-20T18:32:22+00:00

Currently, GRO can do unlimited recursion through the gro_receive
handlers.  This was fixed for tunneling protocols by limiting tunnel GRO
to one level with encap_mark, but both VLAN and TEB still have this
problem.  Thus, the kernel is vulnerable to a stack overflow, if we
receive a packet composed entirely of VLAN headers.

This patch adds a recursion counter to the GRO layer to prevent stack
overflow.  When a gro_receive function hits the recursion limit, GRO is
aborted for this skb and it is processed normally.  This recursion
counter is put in the GRO CB, but could be turned into a percpu counter
if we run out of space in the CB.

Thanks to Vladimír Beneš  for the initial bug report.

Fixes: CVE-2016-7039
Fixes: 9b174d88c257 ("net: Add Transparent Ethernet Bridging GRO support.")
Fixes: 66e5133f19e9 ("vlan: Add GRO support for non hardware accelerated vlan")
Signed-off-by: Sabrina Dubroca 
Reviewed-by: Jiri Benc 
Acked-by: Hannes Frederic Sowa 
Acked-by: Tom Herbert 
Signed-off-by: David S. Miller

gso: Support partial splitting at the frag_list pointer

2016-09-20T00:59:34+00:00

Since commit 8a29111c7 ("net: gro: allow to build full sized skb")
gro may build buffers with a frag_list. This can hurt forwarding
because most NICs can't offload such packets, they need to be
segmented in software. This patch splits buffers with a frag_list
at the frag_list pointer into buffers that can be TSO offloaded.

Signed-off-by: Steffen Klassert 
Acked-by: Alexander Duyck 
Signed-off-by: David S. Miller

ip4ip6: Support for GSO/GRO

2016-05-20T22:03:17+00:00

Signed-off-by: Tom Herbert 
Signed-off-by: David S. Miller

ip6ip6: Support for GSO/GRO

2016-05-20T22:03:17+00:00

Signed-off-by: Tom Herbert 
Signed-off-by: David S. Miller

net: define gso types for IPx over IPv4 and IPv6

2016-05-20T22:03:15+00:00

This patch defines two new GSO definitions SKB_GSO_IPXIP4 and
SKB_GSO_IPXIP6 along with corresponding NETIF_F_GSO_IPXIP4 and
NETIF_F_GSO_IPXIP6. These are used to described IP in IP
tunnel and what the outer protocol is. The inner protocol
can be deduced from other GSO types (e.g. SKB_GSO_TCPV4 and
SKB_GSO_TCPV6). The GSO types of SKB_GSO_IPIP and SKB_GSO_SIT
are removed (these are both instances of SKB_GSO_IPXIP4).
SKB_GSO_IPXIP6 will be used when support for GSO with IP
encapsulation over IPv6 is added.

Signed-off-by: Tom Herbert 
Acked-by: Jeff Kirsher 
Signed-off-by: David S. Miller

gso: Remove arbitrary checks for unsupported GSO

2016-05-20T22:03:15+00:00

In several gso_segment functions there are checks of gso_type against
a seemingly arbitrary list of SKB_GSO_* flags. This seems like an
attempt to identify unsupported GSO types, but since the stack is
the one that set these GSO types in the first place this seems
unnecessary to do. If a combination isn't valid in the first
place that stack should not allow setting it.

This is a code simplication especially for add new GSO types.

Signed-off-by: Tom Herbert 
Signed-off-by: David S. Miller

GSO: Support partial segmentation offload

2016-04-14T20:23:41+00:00

This patch adds support for something I am referring to as GSO partial.
The basic idea is that we can support a broader range of devices for
segmentation if we use fixed outer headers and have the hardware only
really deal with segmenting the inner header.  The idea behind the naming
is due to the fact that everything before csum_start will be fixed headers,
and everything after will be the region that is handled by hardware.

With the current implementation it allows us to add support for the
following GSO types with an inner TSO_MANGLEID or TSO6 offload:
NETIF_F_GSO_GRE
NETIF_F_GSO_GRE_CSUM
NETIF_F_GSO_IPIP
NETIF_F_GSO_SIT
NETIF_F_UDP_TUNNEL
NETIF_F_UDP_TUNNEL_CSUM

In the case of hardware that already supports tunneling we may be able to
extend this further to support TSO_TCPV4 without TSO_MANGLEID if the
hardware can support updating inner IPv4 headers.

Signed-off-by: Alexander Duyck 
Signed-off-by: David S. Miller

GRO: Add support for TCP with fixed IPv4 ID field, limit tunnel IP ID values

2016-04-14T20:23:41+00:00

This patch does two things.

First it allows TCP to aggregate TCP frames with a fixed IPv4 ID field.  As
a result we should now be able to aggregate flows that were converted from
IPv6 to IPv4.  In addition this allows us more flexibility for future
implementations of segmentation as we may be able to use a fixed IP ID when
segmenting the flow.

The second thing this does is that it places limitations on the outer IPv4
ID header in the case of tunneled frames.  Specifically it forces the IP ID
to be incrementing by 1 unless the DF bit is set in the outer IPv4 header.
This way we can avoid creating overlapping series of IP IDs that could
possibly be fragmented if the frame goes through GRO and is then
resegmented via GSO.

Signed-off-by: Alexander Duyck 
Signed-off-by: David S. Miller