linux-stable.git/drivers/net/tun.c, branch v5.8

tun: implement header_ops->parse_protocol for AF_PACKET

2020-06-30T19:29:39+00:00

The tun driver passes up skb->protocol to userspace in the form of PI headers.
For AF_PACKET injection, we need to support its call chain of:

    packet_sendmsg -> packet_snd -> packet_parse_headers ->
      dev_parse_header_protocol -> parse_protocol

Without a valid parse_protocol, this returns zero, and the tun driver
then gives userspace bogus values that it can't deal with.

Note that this isn't the case with tap, because tap already benefits
from the shared infrastructure for ethernet headers. But with tun,
there's nothing.

Signed-off-by: Jason A. Donenfeld 
Signed-off-by: David S. Miller

xdp: Rename convert_to_xdp_frame in xdp_convert_buff_to_frame

2020-06-01T22:02:53+00:00

In order to use standard 'xdp' prefix, rename convert_to_xdp_frame
utility routine in xdp_convert_buff_to_frame and replace all the
occurrences

Signed-off-by: Lorenzo Bianconi 
Signed-off-by: Alexei Starovoitov 
Acked-by: Jesper Dangaard Brouer 
Link: https://lore.kernel.org/bpf/6344f739be0d1a08ab2b9607584c4d5478c8c083.1590698295.git.lorenzo@kernel.org

tun: correct header offsets in napi frags mode

2020-06-01T19:01:46+00:00

Tun in IFF_NAPI_FRAGS mode calls napi_gro_frags. Unlike netif_rx and
netif_gro_receive, this expects skb->data to point to the mac layer.

But skb_probe_transport_header, __skb_get_hash_symmetric, and
xdp_do_generic in tun_get_user need skb->data to point to the network
header. Flow dissection also needs skb->protocol set, so
eth_type_trans has to be called.

Ensure the link layer header lies in linear as eth_type_trans pulls
ETH_HLEN. Then take the same code paths for frags as for not frags.
Push the link layer header back just before calling napi_gro_frags.

By pulling up to ETH_HLEN from frag0 into linear, this disables the
frag0 optimization in the special case when IFF_NAPI_FRAGS is used
with zero length iov[0] (and thus empty skb->linear).

Fixes: 90e33d459407 ("tun: enable napi_gro_frags() for TUN/TAP driver")
Signed-off-by: Willem de Bruijn 
Acked-by: Petar Penkov 
Signed-off-by: David S. Miller

tun: Add XDP frame size

2020-05-15T04:21:55+00:00

The tun driver have two code paths for running XDP (bpf_prog_run_xdp).
In both cases 'buflen' contains enough tailroom for skb_shared_info.

Signed-off-by: Jesper Dangaard Brouer 
Signed-off-by: Alexei Starovoitov 
Acked-by: Michael S. Tsirkin 
Acked-by: Jason Wang 
Link: https://lore.kernel.org/bpf/158945343419.97035.9594485183958037621.stgit@firesoul

net: tun: record RX queue in skb before do_xdp_generic()

2020-04-13T03:58:24+00:00

This allows netif_receive_generic_xdp() to correctly determine the RX
queue from which the skb is coming, so that the context passed to the
XDP program will contain the correct RX queue index.

Signed-off-by: Gilberto Bertin 
Signed-off-by: David S. Miller

tun: Don't put_page() for all negative return values from XDP program

2020-04-06T17:00:43+00:00

When an XDP program is installed, tun_build_skb() grabs a reference to
the current page fragment page if the program returns XDP_REDIRECT or
XDP_TX. However, since tun_xdp_act() passes through negative return
values from the XDP program, it is possible to trigger the error path by
mistake and accidentally drop a reference to the fragments page without
taking one, leading to a spurious free. This is believed to be the cause
of some KASAN use-after-free reports from syzbot [1], although without a
reproducer it is not possible to confirm whether this patch fixes the
problem.

Ensure that we only drop a reference to the fragments page if the XDP
transmit or redirect operations actually fail.

[1] https://syzkaller.appspot.com/bug?id=e76a6af1be4acd727ff6bbca669833f98cbf5d95

Cc: "David S. Miller" 
Cc: Alexei Starovoitov 
Cc: Daniel Borkmann 
CC: Eric Dumazet 
Acked-by: Jason Wang 
Fixes: 8ae1aff0b331 ("tuntap: split out XDP logic")
Signed-off-by: Will Deacon 
Signed-off-by: David S. Miller

tun: reject unsupported coalescing params

2020-03-07T06:45:55+00:00

Set ethtool_ops->supported_coalesce_params to let
the core reject unsupported coalescing parameters.

This driver did not previously reject unsupported parameters.

Signed-off-by: Jakub Kicinski 
Acked-by: Jason Wang 
Signed-off-by: David S. Miller

tun: drop TUN_DEBUG and tun_debug()

2020-03-06T05:38:03+00:00

TUN_DEBUG and tun_debug() are no longer used anywhere, drop them.

Signed-off-by: Michal Kubecek 
Signed-off-by: David S. Miller

tun: replace tun_debug() by netif_info()

2020-03-06T05:38:02+00:00

The tun driver uses custom macro tun_debug() which is only available if
TUN_DEBUG is set. Replace it by standard netif_ifinfo(). For that purpose,
rename tun_struct::debug to msg_enable and make it u32 and always present.
Finally, make tun_get_msglevel(), tun_set_msglevel() and TUNSETDEBUG ioctl
independent of TUN_DEBUG.

Signed-off-by: Michal Kubecek 
Signed-off-by: David S. Miller

tun: drop useless debugging statements

2020-03-06T05:38:02+00:00

Some of the tun_debug() statements only inform us about entering
a function which can be easily achieved with ftrace or kprobe. As
tun_debug() is no-op unless TUN_DEBUG is set which requires editing the
source and recompiling, setting up ftrace or kprobe is easier. Drop these
debug statements.

Also drop the tun_debug() statement informing about SIOCSIFHWADDR ioctl.
We can monitor these through rtnetlink and it makes little sense to log
address changes through ioctl but not changes through rtnetlink. Moreover,
this tun_debug() is called even if the actual address change fails which
makes it even less useful.

Signed-off-by: Michal Kubecek 
Signed-off-by: David S. Miller