net: fix possible wrong checksum generation

Pravin Shelar mentioned that GSO could potentially generate wrong TX checksum if skb has fragments that are overwritten by the user between the checksum computation and transmit. He suggested to linearize skbs but this extra copy can be avoided for normal tcp skbs cooked by tcp_sendmsg(). This patch introduces a new SKB_GSO_SHARED_FRAG flag, set in skb_shinfo(skb)->gso_type if at least one frag can be modified by the user. Typical sources of such possible overwrites are {vm}splice(), sendfile(), and macvtap/tun/virtio_net drivers. Tested: $ netperf -H 7.7.8.84 MIGRATED TCP STREAM TEST from 0.0.0.0 (0.0.0.0) port 0 AF_INET to 7.7.8.84 () port 0 AF_INET Recv Send Send Socket Socket Message Elapsed Size Size Size Time Throughput bytes bytes bytes secs. 10^6bits/sec 87380 16384 16384 10.00 3959.52 $ netperf -H 7.7.8.84 -t TCP_SENDFILE TCP SENDFILE TEST from 0.0.0.0 (0.0.0.0) port 0 AF_INET to 7.7.8.84 () port 0 AF_INET Recv Send Send Socket Socket Message Elapsed Size Size Size Time Throughput bytes bytes bytes secs. 10^6bits/sec 87380 16384 16384 10.00 3216.80 Performance of the SENDFILE is impacted by the extra allocation and copy, and because we use order-0 pages, while the TCP_STREAM uses bigger pages.

Eric Dumazet committed 13 years ago

Commit cef401d1 parent 615500213 files · +65 −15Browse files

Unified · Split

13 files

drivers/net/macvtap.c +2 −1
drivers/net/tun.c +8 −4
drivers/net/virtio_net.c +8 −4
include/linux/skbuff.h +19 −0
net/core/dev.c +9 −0
net/core/skbuff.c +4 −0
net/ipv4/af_inet.c +1 −0
net/ipv4/ip_gre.c +3 −1
net/ipv4/ipip.c +3 −1
net/ipv4/tcp.c +3 −0
net/ipv4/tcp_input.c +2 −2
net/ipv4/tcp_output.c +2 −2
net/ipv6/ip6_offload.c +1 −0

drivers/net/macvtap.c+2−1

 		skb->data_len += len;
 		skb->len += len;
 		skb->truesize += truesize;
+		skb_shinfo(skb)->gso_type |= SKB_GSO_SHARED_FRAG;
 		atomic_add(truesize, &skb->sk->sk_wmem_alloc);
 		while (len) {
 			int off = base & ~PAGE_MASK;
 	if (vnet_hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) {
 		skb_shinfo(skb)->gso_size = vnet_hdr->gso_size;
-		skb_shinfo(skb)->gso_type = gso_type;
+		skb_shinfo(skb)->gso_type |= gso_type;
 		/* Header must be checked, and gso_segs computed. */
 		skb_shinfo(skb)->gso_type |= SKB_GSO_DODGY;

drivers/net/tun.c+8−4

 		skb->data_len += len;
 		skb->len += len;
 		skb->truesize += truesize;
+		skb_shinfo(skb)->gso_type |= SKB_GSO_SHARED_FRAG;
 		atomic_add(truesize, &skb->sk->sk_wmem_alloc);
 		while (len) {
 			int off = base & ~PAGE_MASK;
 	}
 	if (gso.gso_type != VIRTIO_NET_HDR_GSO_NONE) {
+		unsigned short gso_type = 0;
 		pr_debug("GSO!\n");
 		switch (gso.gso_type & ~VIRTIO_NET_HDR_GSO_ECN) {
 		case VIRTIO_NET_HDR_GSO_TCPV4:
-			skb_shinfo(skb)->gso_type = SKB_GSO_TCPV4;
+			gso_type = SKB_GSO_TCPV4;
 			break;
 		case VIRTIO_NET_HDR_GSO_TCPV6:
-			skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6;
+			gso_type = SKB_GSO_TCPV6;
 			break;
 		case VIRTIO_NET_HDR_GSO_UDP:
-			skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
+			gso_type = SKB_GSO_UDP;
 			break;
 		default:
 			tun->dev->stats.rx_frame_errors++;
 		}
 		if (gso.gso_type & VIRTIO_NET_HDR_GSO_ECN)
-			skb_shinfo(skb)->gso_type |= SKB_GSO_TCP_ECN;
+			gso_type |= SKB_GSO_TCP_ECN;
 		skb_shinfo(skb)->gso_size = gso.gso_size;
+		skb_shinfo(skb)->gso_type |= gso_type;
 		if (skb_shinfo(skb)->gso_size == 0) {
 			tun->dev->stats.rx_frame_errors++;
 			kfree_skb(skb);

drivers/net/virtio_net.c+8−4

 	skb->len += size;
 	skb->truesize += PAGE_SIZE;
 	skb_shinfo(skb)->nr_frags++;
+	skb_shinfo(skb)->gso_type |= SKB_GSO_SHARED_FRAG;
 	*len -= size;
 }
 		 ntohs(skb->protocol), skb->len, skb->pkt_type);
 	if (hdr->hdr.gso_type != VIRTIO_NET_HDR_GSO_NONE) {
+		unsigned short gso_type = 0;
 		pr_debug("GSO!\n");
 		switch (hdr->hdr.gso_type & ~VIRTIO_NET_HDR_GSO_ECN) {
 		case VIRTIO_NET_HDR_GSO_TCPV4:
-			skb_shinfo(skb)->gso_type = SKB_GSO_TCPV4;
+			gso_type = SKB_GSO_TCPV4;
 			break;
 		case VIRTIO_NET_HDR_GSO_UDP:
-			skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
+			gso_type = SKB_GSO_UDP;
 			break;
 		case VIRTIO_NET_HDR_GSO_TCPV6:
-			skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6;
+			gso_type = SKB_GSO_TCPV6;
 			break;
 		default:
 			net_warn_ratelimited("%s: bad gso type %u.\n",
 		}
 		if (hdr->hdr.gso_type & VIRTIO_NET_HDR_GSO_ECN)
-			skb_shinfo(skb)->gso_type |= SKB_GSO_TCP_ECN;
+			gso_type |= SKB_GSO_TCP_ECN;
 		skb_shinfo(skb)->gso_size = hdr->hdr.gso_size;
 		if (skb_shinfo(skb)->gso_size == 0) {
 			goto frame_err;
 		}
+		skb_shinfo(skb)->gso_type |= gso_type;
 		/* Header must be checked, and gso_segs computed. */
 		skb_shinfo(skb)->gso_type |= SKB_GSO_DODGY;
 		skb_shinfo(skb)->gso_segs = 0;

include/linux/skbuff.h+19−0

@@ -307,6 +307,13 @@ enum { · 306 unmodified lines
307	SKB_GSO_TCPV6 = 1 << 4,	307	SKB_GSO_TCPV6 = 1 << 4,
308		308
309	SKB_GSO_FCOE = 1 << 5,	309	SKB_GSO_FCOE = 1 << 5,
		310
		311	/* This indicates at least one fragment might be overwritten
		312	* (as in vmsplice(), sendfile() ...)
		313	* If we need to compute a TX checksum, we'll need to copy
		314	* all frags to avoid possible bad checksum
		315	*/
		316	SKB_GSO_SHARED_FRAG = 1 << 6,
310	};	317	};
311		318
312	#if BITS_PER_LONG > 32	319	#if BITS_PER_LONG > 32
@@ -2200,6 +2207,18 @@ static inline int skb_linearize(struct sk_buff *skb) · 1887 unmodified lines
2200	return skb_is_nonlinear(skb) ? __skb_linearize(skb) : 0;	2207	return skb_is_nonlinear(skb) ? __skb_linearize(skb) : 0;
2201	}	2208	}
2202		2209
		2210	/**
		2211	* skb_has_shared_frag - can any frag be overwritten
		2212	* @skb: buffer to test
		2213	*
		2214	* Return true if the skb has at least one frag that might be modified
		2215	* by an external entity (as in vmsplice()/sendfile())
		2216	*/
		2217	static inline bool skb_has_shared_frag(const struct sk_buff *skb)
		2218	{
		2219	return skb_shinfo(skb)->gso_type & SKB_GSO_SHARED_FRAG;
		2220	}
		2221
2203	/**	2222	/**
2204	* skb_linearize_cow - make sure skb is linear and writable	2223	* skb_linearize_cow - make sure skb is linear and writable
2205	* @skb: buffer to process	2224	* @skb: buffer to process

net/core/dev.c+9−0

@@ -2271,6 +2271,15 @@ int skb_checksum_help(struct sk_buff *skb) · 2270 unmodified lines
2271	return -EINVAL;	2271	return -EINVAL;
2272	}	2272	}
2273		2273
		2274	/* Before computing a checksum, we should make sure no frag could
		2275	* be modified by an external entity : checksum could be wrong.
		2276	*/
		2277	if (skb_has_shared_frag(skb)) {
		2278	ret = __skb_linearize(skb);
		2279	if (ret)
		2280	goto out;
		2281	}
		2282
2274	offset = skb_checksum_start_offset(skb);	2283	offset = skb_checksum_start_offset(skb);
2275	BUG_ON(offset >= skb_headlen(skb));	2284	BUG_ON(offset >= skb_headlen(skb));
2276	csum = skb_checksum(skb, offset, skb->len - offset, 0);	2285	csum = skb_checksum(skb, offset, skb->len - offset, 0);

net/core/skbuff.c+4−0

 {
 	int pos = skb_headlen(skb);
+	skb_shinfo(skb1)->gso_type = skb_shinfo(skb)->gso_type;
 	if (len < pos)	/* Split line is inside header. */
 		skb_split_inside_header(skb, skb1, len, pos);
 	else		/* Second chunk has no header, nothing to copy. */
 		skb_copy_from_linear_data_offset(skb, offset,
 						 skb_put(nskb, hsize), hsize);
+		skb_shinfo(nskb)->gso_type = skb_shinfo(skb)->gso_type;
 		while (pos < offset + len && i < nfrags) {
 			*frag = skb_shinfo(skb)->frags[i];
 			__skb_frag_ref(frag);

net/ipv4/af_inet.c+1−0

@@ -1306,6 +1306,7 @@ static struct sk_buff inet_gso_segment(struct sk_buff skb, · 1305 unmodified lines
1306	SKB_GSO_UDP \|	1306	SKB_GSO_UDP \|
1307	SKB_GSO_DODGY \|	1307	SKB_GSO_DODGY \|
1308	SKB_GSO_TCP_ECN \|	1308	SKB_GSO_TCP_ECN \|
		1309	SKB_GSO_SHARED_FRAG \|
1309	0)))	1310	0)))
1310	goto out;	1311	goto out;
1311		1312

net/ipv4/ip_gre.c+3−1

 static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
 {
 	struct ip_tunnel *tunnel = netdev_priv(dev);
-	const struct iphdr  *old_iph = ip_hdr(skb);
+	const struct iphdr  *old_iph;
 	const struct iphdr  *tiph;
 	struct flowi4 fl4;
 	u8     tos;
 	    skb_checksum_help(skb))
 		goto tx_error;
+	old_iph = ip_hdr(skb);
 	if (dev->type == ARPHRD_ETHER)
 		IPCB(skb)->flags = 0;

net/ipv4/ipip.c+3−1

 	__be16 df = tiph->frag_off;
 	struct rtable *rt;     			/* Route to the other host */
 	struct net_device *tdev;		/* Device to other host */
-	const struct iphdr  *old_iph = ip_hdr(skb);
+	const struct iphdr  *old_iph;
 	struct iphdr  *iph;			/* Our new IP header */
 	unsigned int max_headroom;		/* The extra header space needed */
 	__be32 dst = tiph->daddr;
 	    skb_checksum_help(skb))
 		goto tx_error;
+	old_iph = ip_hdr(skb);
 	if (tos & 1)
 		tos = old_iph->tos;

net/ipv4/tcp.c+3−0

 			skb_fill_page_desc(skb, i, page, offset, copy);
 		}
+		skb_shinfo(skb)->gso_type |= SKB_GSO_SHARED_FRAG;
 		skb->len += copy;
 		skb->data_len += copy;
 		skb->truesize += copy;
 			       SKB_GSO_DODGY |
 			       SKB_GSO_TCP_ECN |
 			       SKB_GSO_TCPV6 |
+			       SKB_GSO_SHARED_FRAG |
 			       0) ||
 			     !(type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6))))
 			goto out;

net/ipv4/tcp_input.c+2−2

@@ -1240,13 +1240,13 @@ static bool tcp_shifted_skb(struct sock sk, struct sk_buff skb, · 1239 unmodified lines
1240	*/	1240	*/
1241	if (!skb_shinfo(prev)->gso_size) {	1241	if (!skb_shinfo(prev)->gso_size) {
1242	skb_shinfo(prev)->gso_size = mss;	1242	skb_shinfo(prev)->gso_size = mss;
1243	skb_shinfo(prev)->gso_type = sk->sk_gso_type;	1243	skb_shinfo(prev)->gso_type \|= sk->sk_gso_type;
1244	}	1244	}
1245		1245
1246	/* CHECKME: To clear or not to clear? Mimics normal skb currently */	1246	/* CHECKME: To clear or not to clear? Mimics normal skb currently */
1247	if (skb_shinfo(skb)->gso_segs <= 1) {	1247	if (skb_shinfo(skb)->gso_segs <= 1) {
1248	skb_shinfo(skb)->gso_size = 0;	1248	skb_shinfo(skb)->gso_size = 0;
1249	skb_shinfo(skb)->gso_type = 0;	1249	skb_shinfo(skb)->gso_type &= SKB_GSO_SHARED_FRAG;
1250	}	1250	}
1251		1251
1252	/* Difference in this won't matter, both ACKed by the same cumul. ACK */	1252	/* Difference in this won't matter, both ACKed by the same cumul. ACK */

net/ipv4/tcp_output.c+2−2

 static void tcp_set_skb_tso_segs(const struct sock *sk, struct sk_buff *skb,
 				 unsigned int mss_now)
 {
+	skb_shinfo(skb)->gso_type &= SKB_GSO_SHARED_FRAG;
 	if (skb->len <= mss_now || !sk_can_gso(sk) ||
 	    skb->ip_summed == CHECKSUM_NONE) {
 		/* Avoid the costly divide in the normal
 		 */
 		skb_shinfo(skb)->gso_segs = 1;
 		skb_shinfo(skb)->gso_size = 0;
-		skb_shinfo(skb)->gso_type = 0;
 	} else {
 		skb_shinfo(skb)->gso_segs = DIV_ROUND_UP(skb->len, mss_now);
 		skb_shinfo(skb)->gso_size = mss_now;
-		skb_shinfo(skb)->gso_type = sk->sk_gso_type;
+		skb_shinfo(skb)->gso_type |= sk->sk_gso_type;
 	}
 }

net/ipv6/ip6_offload.c+1−0

@@ -100,6 +100,7 @@ static struct sk_buff ipv6_gso_segment(struct sk_buff skb, · 99 unmodified lines
100	SKB_GSO_DODGY \|	100	SKB_GSO_DODGY \|
101	SKB_GSO_TCP_ECN \|	101	SKB_GSO_TCP_ECN \|
102	SKB_GSO_TCPV6 \|	102	SKB_GSO_TCPV6 \|
		103	SKB_GSO_SHARED_FRAG \|
103	0)))	104	0)))
104	goto out;	105	goto out;
105		106

net: fix possible wrong checksum generation

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code