From nobody Mon Apr 6 12:33:14 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 11B8CC38145 for ; Wed, 7 Sep 2022 10:58:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229902AbiIGK63 (ORCPT ); Wed, 7 Sep 2022 06:58:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54016 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229561AbiIGK60 (ORCPT ); Wed, 7 Sep 2022 06:58:26 -0400 X-Greylist: delayed 1501 seconds by postgrey-1.37 at lindbergh.monkeyblade.net; Wed, 07 Sep 2022 03:58:21 PDT Received: from smart-D.hosteam.fr (smart-D.hosteam.fr [91.206.156.179]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F0622979E4; Wed, 7 Sep 2022 03:58:20 -0700 (PDT) Received: from mail.gatewatcher.com (unknown [192.168.3.58]) by smart-D.hosteam.fr (Postfix) with ESMTPS id C43602A19E0; Wed, 7 Sep 2022 12:08:59 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gatewatcher.com; s=hosteamdkim; t=1662545339; bh=Gb0O+oTPwGmm0v9ITQNaFqxx7I8R0OzeKRA7GcgCDJE=; h=From:To:CC:Subject:Date:From; b=fPZSjQFUbQzouMsJACml/zddw5Kj2viDEG0L+JjXZFGoQtSO4rqqWD0VA+iuUNTte ySAujw5MrrgdRk4qiaW5x3SMG09GUmpfvhRxGdorNnX95DAoIhszIc7whuodVKQQ8N ebkOURJQ9g52MpUNrxdwLaZ+r6YKhOXBOiuKwBYw= Received: from gatewatcher.com (192.168.145.72) by GWCHR-EXCH01B.adexch.gatewatcher.com (192.168.145.5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.986.22; Wed, 7 Sep 2022 12:08:59 +0200 From: To: CC: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Boris Sukholitko , Kurt Kanzenbach , Vlad Buslov , Wojciech Drewek , Yoshiki Komachi , Paul Blakey , Tom Herbert , , Subject: [PATCH net v1] net: core: fix flow symmetric hash Date: Wed, 7 Sep 2022 12:08:13 +0200 Message-ID: <20220907100814.1549196-1-ludovic.cintrat@gatewatcher.com> X-Mailer: git-send-email 2.30.2 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [192.168.145.72] X-ClientProxiedBy: GWCHR-EXCH01B.adexch.gatewatcher.com (192.168.145.5) To GWCHR-EXCH01B.adexch.gatewatcher.com (192.168.145.5) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ludovic Cintrat __flow_hash_consistentify() wrongly swaps ipv4 addresses in few cases. This function is indirectly used by __skb_get_hash_symmetric(), which is used to fanout packets in AF_PACKET. Intrusion detection systems may be impacted by this issue. __flow_hash_consistentify() computes the addresses difference then swaps them if the difference is negative. In few cases src - dst and dst - src are both negative. The following snippet mimics __flow_hash_consistentify(): ``` #include #include int main(int argc, char** argv) { int diffs_d, diffd_s; uint32_t dst =3D 0xb225a8c0; /* 178.37.168.192 --> 192.168.37.178 */ uint32_t src =3D 0x3225a8c0; /* 50.37.168.192 --> 192.168.37.50 */ uint32_t dst2 =3D 0x3325a8c0; /* 51.37.168.192 --> 192.168.37.51 */ diffs_d =3D src - dst; diffd_s =3D dst - src; printf("src:%08x dst:%08x, diff(s-d)=3D%d(0x%x) diff(d-s)=3D%d(0x%x)\n= ", src, dst, diffs_d, diffs_d, diffd_s, diffd_s); diffs_d =3D src - dst2; diffd_s =3D dst2 - src; printf("src:%08x dst:%08x, diff(s-d)=3D%d(0x%x) diff(d-s)=3D%d(0x%x)\n= ", src, dst2, diffs_d, diffs_d, diffd_s, diffd_s); return 0; } ``` Results: src:3225a8c0 dst:b225a8c0, \ diff(s-d)=3D-2147483648(0x80000000) \ diff(d-s)=3D-2147483648(0x80000000) src:3225a8c0 dst:3325a8c0, \ diff(s-d)=3D-16777216(0xff000000) \ diff(d-s)=3D16777216(0x1000000) In the first case the addresses differences are always < 0, therefore __flow_hash_consistentify() always swaps, thus dst->src and src->dst packets have differents hashes. Fixes: c3f8324188fa8 ("net: Add full IPv6 addresses to flow_keys") Signed-off-by: Ludovic Cintrat --- net/core/flow_dissector.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c index 764c4cb3fe8f..5dc3860e9fc7 100644 --- a/net/core/flow_dissector.c +++ b/net/core/flow_dissector.c @@ -1611,9 +1611,8 @@ static inline void __flow_hash_consistentify(struct f= low_keys *keys) =20 switch (keys->control.addr_type) { case FLOW_DISSECTOR_KEY_IPV4_ADDRS: - addr_diff =3D (__force u32)keys->addrs.v4addrs.dst - - (__force u32)keys->addrs.v4addrs.src; - if (addr_diff < 0) + if ((__force u32)keys->addrs.v4addrs.dst < + (__force u32)keys->addrs.v4addrs.src) swap(keys->addrs.v4addrs.src, keys->addrs.v4addrs.dst); =20 if ((__force u16)keys->ports.dst < --=20 2.30.2