From nobody Sat Feb 7 17:55:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B7944C001DD for ; Thu, 13 Jul 2023 01:55:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233390AbjGMBze (ORCPT ); Wed, 12 Jul 2023 21:55:34 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37302 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231901AbjGMBzb (ORCPT ); Wed, 12 Jul 2023 21:55:31 -0400 Received: from mail-qk1-x72e.google.com (mail-qk1-x72e.google.com [IPv6:2607:f8b0:4864:20::72e]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 54B332115 for ; Wed, 12 Jul 2023 18:55:24 -0700 (PDT) Received: by mail-qk1-x72e.google.com with SMTP id af79cd13be357-7653bd3ff2fso22422085a.3 for ; Wed, 12 Jul 2023 18:55:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cloudflare.com; s=google; t=1689213323; x=1691805323; h=content-disposition:mime-version:message-id:subject:cc:to:from:date :from:to:cc:subject:date:message-id:reply-to; bh=IC4l+DMQhb6kc5rWIsMuFvnWetpCKotmNlfSav918o4=; b=VdDCd2rwQPbltzkne/8cYfxnkuaCKmFeRcipHkeV5r5b9iyVOJ/o/XOTDIvxXsoZRq kzJrj9I6zxi8mHbcPDLKrJ/iTuQu+OTIzr6ATwW+JkoDfWEFyD+x2vOHh7fxGo4ZF1Xs PvudhpsE7CEWCSNNZfNksQ00yWADTZWPg5X8w= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1689213323; x=1691805323; h=content-disposition:mime-version:message-id:subject:cc:to:from:date :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=IC4l+DMQhb6kc5rWIsMuFvnWetpCKotmNlfSav918o4=; b=jnXiwHiu6B5WbXKndVP46WSvimQ5ss23eRHbWuMJ8Mul0YIv1W6FdlZKs9rNhZrujM kKCYA/wpVv5PHvWtKchC0spJQ/qmV+8IO7tHASs5x9ykoWct2VM/mCTzkqgye2iZIDec fZJKfysWvNN9ATGbFTC3/ozsaTPOcVmojCe4tyxdluQkKRsot1e5aEp2v+J6Z6R6xH+T 84qh9CWtDwNoVKTKOhWwahJqSQ+V0B4J988UrQAvJ37xfisLeAhXa1GHFlDDUaa1i/bn f914T6oYNTezoRcLbutzILilIN6OwzAjLwt5EesQyf6V+QU8NTmawUMjC7La7HV6MK3f JQcw== X-Gm-Message-State: ABy/qLao8ATquhZtgyffvVz4LjOGXSIGHyEH8YXyikHmmxg8xchkfoYt IHgJr8U1H9OivdNEg7sWchNJCUTzsbAY3uqTG+YJ2A== X-Google-Smtp-Source: APBJJlHXnjSSjDOxycQFia95pEocVbUmuLmuF+evJsLCFSQS9qAmMqhl9alS5Ioe+fxOUCbJ3wKqug== X-Received: by 2002:a05:620a:198e:b0:767:173e:9 with SMTP id bm14-20020a05620a198e00b00767173e0009mr233241qkb.58.1689213323421; Wed, 12 Jul 2023 18:55:23 -0700 (PDT) Received: from debian.debian ([140.141.197.139]) by smtp.gmail.com with ESMTPSA id e1-20020a05620a208100b0076729e726cbsm2580913qka.22.2023.07.12.18.55.22 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 12 Jul 2023 18:55:22 -0700 (PDT) Date: Wed, 12 Jul 2023 18:55:20 -0700 From: Yan Zhai To: "open list:NETWORKING [TCP]" Cc: kernel-team@cloudflare.com, Eric Dumazet , "David S. Miller" , David Ahern , Jakub Kicinski , Paolo Abeni , Marcelo Ricardo Leitner , Xin Long , Herbert Xu , Andrew Melnychenko , Jason Wang , Willem de Bruijn , open list , "open list:SCTP PROTOCOL" Subject: [PATCH net] gso: fix GSO_DODGY bit handling for related protocols Message-ID: MIME-Version: 1.0 Content-Disposition: inline Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" SKB_GSO_DODGY bit indicates a GSO packet comes from an untrusted source. The canonical way is to recompute the gso_segs to avoid device driver issues. Afterwards, the DODGY bit can be removed to avoid re-check at the egress of later devices, e.g. packets can egress to a vlan device backed by a real NIC. Commit 1fd54773c267 ("udp: allow header check for dodgy GSO_UDP_L4 packets.") checks DODGY bit for UDP, but for packets that can be fed directly to the device after gso_segs reset, it actually falls through to fragmentation [1]. Commit 90017accff61 ("sctp: Add GSO support") and commit 3820c3f3e417 ("[TCP]: Reset gso_segs if packet is dodgy") both didn't remove the DODGY bit after recomputing gso_segs. This change fixes the GSO_UDP_L4 handling case, and remove the DODGY bit at other places. Fixes: 90017accff61 ("sctp: Add GSO support") Fixes: 3820c3f3e417 ("[TCP]: Reset gso_segs if packet is dodgy") Fixes: 1fd54773c267 ("udp: allow header check for dodgy GSO_UDP_L4 packets.= ") Signed-off-by: Yan Zhai --- [1]: https://lore.kernel.org/all/CAJPywTKDdjtwkLVUW6LRA2FU912qcDmQOQGt2WaDo28KzY= Dg+A@mail.gmail.com/ --- net/ipv4/tcp_offload.c | 1 + net/ipv4/udp_offload.c | 19 +++++++++++++++---- net/ipv6/udp_offload.c | 19 +++++++++++++++---- net/sctp/offload.c | 2 ++ 4 files changed, 33 insertions(+), 8 deletions(-) diff --git a/net/ipv4/tcp_offload.c b/net/ipv4/tcp_offload.c index 8311c38267b5..f9b93708c22e 100644 --- a/net/ipv4/tcp_offload.c +++ b/net/ipv4/tcp_offload.c @@ -87,6 +87,7 @@ struct sk_buff *tcp_gso_segment(struct sk_buff *skb, /* Packet is from an untrusted source, reset gso_segs. */ =20 skb_shinfo(skb)->gso_segs =3D DIV_ROUND_UP(skb->len, mss); + skb_shinfo(skb)->gso_type &=3D ~SKB_GSO_DODGY; =20 segs =3D NULL; goto out; diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c index 75aa4de5b731..bd29cf19bb6b 100644 --- a/net/ipv4/udp_offload.c +++ b/net/ipv4/udp_offload.c @@ -388,11 +388,22 @@ static struct sk_buff *udp4_ufo_fragment(struct sk_bu= ff *skb, if (!pskb_may_pull(skb, sizeof(struct udphdr))) goto out; =20 - if (skb_shinfo(skb)->gso_type & SKB_GSO_UDP_L4 && - !skb_gso_ok(skb, features | NETIF_F_GSO_ROBUST)) - return __udp_gso_segment(skb, features, false); - mss =3D skb_shinfo(skb)->gso_size; + + if (skb_shinfo(skb)->gso_type & SKB_GSO_UDP_L4) { + if (skb_gso_ok(skb, features | NETIF_F_GSO_ROBUST)) { + /* Packet is from an untrusted source, reset actual gso_segs */ + skb_shinfo(skb)->gso_segs =3D DIV_ROUND_UP(skb->len - sizeof(*uh), + mss); + skb_shinfo(skb)->gso_type &=3D ~SKB_GSO_DODGY; + + segs =3D NULL; + goto out; + } else { + return __udp_gso_segment(skb, features, false); + } + } + if (unlikely(skb->len <=3D mss)) goto out; =20 diff --git a/net/ipv6/udp_offload.c b/net/ipv6/udp_offload.c index ad3b8726873e..6857d9f7bd06 100644 --- a/net/ipv6/udp_offload.c +++ b/net/ipv6/udp_offload.c @@ -43,11 +43,22 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff= *skb, if (!pskb_may_pull(skb, sizeof(struct udphdr))) goto out; =20 - if (skb_shinfo(skb)->gso_type & SKB_GSO_UDP_L4 && - !skb_gso_ok(skb, features | NETIF_F_GSO_ROBUST)) - return __udp_gso_segment(skb, features, true); - mss =3D skb_shinfo(skb)->gso_size; + + if (skb_shinfo(skb)->gso_type & SKB_GSO_UDP_L4) { + if (skb_gso_ok(skb, features | NETIF_F_GSO_ROBUST)) { + /* Packet is from an untrusted source, reset actual gso_segs */ + skb_shinfo(skb)->gso_segs =3D DIV_ROUND_UP(skb->len - sizeof(*uh), + mss); + skb_shinfo(skb)->gso_type &=3D ~SKB_GSO_DODGY; + + segs =3D NULL; + goto out; + } else { + return __udp_gso_segment(skb, features, true); + } + } + if (unlikely(skb->len <=3D mss)) goto out; =20 diff --git a/net/sctp/offload.c b/net/sctp/offload.c index 502095173d88..3d2b44db0d42 100644 --- a/net/sctp/offload.c +++ b/net/sctp/offload.c @@ -65,6 +65,8 @@ static struct sk_buff *sctp_gso_segment(struct sk_buff *s= kb, skb_walk_frags(skb, frag_iter) pinfo->gso_segs++; =20 + pinfo->gso_type &=3D ~SKB_GSO_DODGY; + segs =3D NULL; goto out; } --=20 2.30.2