Felix Fietkau wrote: > On 22.09.24 17:03, Willem de Bruijn wrote: > > From: Willem de Bruijn <willemb@xxxxxxxxxx> > > > > Detect gso fraglist skbs with corrupted geometry (see below) and > > pass these to skb_segment instead of skb_segment_list, as the first > > can segment them correctly. > > > > Valid SKB_GSO_FRAGLIST skbs > > - consist of two or more segments > > - the head_skb holds the protocol headers plus first gso_size > > - one or more frag_list skbs hold exactly one segment > > - all but the last must be gso_size > > > > Optional datapath hooks such as NAT and BPF (bpf_skb_pull_data) can > > modify these skbs, breaking these invariants. > > > > In extreme cases they pull all data into skb linear. For UDP, this > > causes a NULL ptr deref in __udpv4_gso_segment_list_csum at > > udp_hdr(seg->next)->dest. > > > > Detect invalid geometry due to pull, by checking head_skb size. > > Don't just drop, as this may blackhole a destination. Convert to be > > able to pass to regular skb_segment. > > > > Link: https://lore.kernel.org/netdev/20240428142913.18666-1-shiming.cheng@xxxxxxxxxxxx/ > > Fixes: 3a1296a38d0c ("net: Support GRO/GSO fraglist chaining.") > > Signed-off-by: Willem de Bruijn <willemb@xxxxxxxxxx> > > Cc: stable@xxxxxxxxxxxxxxx > > > > --- > > diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c > > index d842303587af..e457fa9143a6 100644 > > --- a/net/ipv4/udp_offload.c > > +++ b/net/ipv4/udp_offload.c > > @@ -296,8 +296,16 @@ struct sk_buff *__udp_gso_segment(struct sk_buff *gso_skb, > > return NULL; > > } > > > > - if (skb_shinfo(gso_skb)->gso_type & SKB_GSO_FRAGLIST) > > - return __udp_gso_segment_list(gso_skb, features, is_ipv6); > > + if (skb_shinfo(gso_skb)->gso_type & SKB_GSO_FRAGLIST) { > > + /* Detect modified geometry and pass these to skb_segment. */ > > + if (skb_pagelen(gso_skb) - sizeof(*uh) == skb_shinfo(gso_skb)->gso_size) > > + return __udp_gso_segment_list(gso_skb, features, is_ipv6); > > + > > + /* Setup csum, as fraglist skips this in udp4_gro_receive. */ > > + gso_skb->csum_start = skb_transport_header(gso_skb) - gso_skb->head; > > + gso_skb->csum_offset = offsetof(struct udphdr, check); > > + gso_skb->ip_summed = CHECKSUM_PARTIAL; > > + } > > It seems to me that the TCP code would need something similar. I think you're right, thanks. Separate patch, as different Fixes, of course. > Do you think the same approach would work there as well? tcp4_gro_complete seems to mirror udp4_gro_receive in returning early before setting up checksum offload. So likely yes. The script I shared to reproduce for UDP can hopefully be reused easily to also generate these packets with TCP. > Thanks, > > - Felix
