linux-stable.git/net/core/skbuff.c, branch linux-5.6.y

net: fix fraglist segmentation reference count leak

2020-04-08T07:11:03+00:00

[ Upstream commit cf673ed0e057a2dd68d930c6d7e30d53c70c5789 ]

Xin Long says:
 On udp rx path udp_rcv_segment() may do segment where the frag skbs
 will get the header copied from the head skb in skb_segment_list()
 by calling __copy_skb_header(), which could overwrite the frag skbs'
 extensions by __skb_ext_copy() and cause a leak.

 This issue was found after loading esp_offload where a sec path ext
 is set in the skb.

Fix this by discarding head state of the fraglist skb before replacing
its contents.

Fixes: 3a1296a38d0cf62 ("net: Support GRO/GSO fraglist chaining.")
Cc: Steffen Klassert 
Reported-by: Xiumei Mu 
Tested-by: Xin Long 
Signed-off-by: Florian Westphal 
Acked-by: Steffen Klassert 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

net: core: Distribute switch variables for initialization

2020-02-20T18:00:19+00:00

Variables declared in a switch statement before any case statements
cannot be automatically initialized with compiler instrumentation (as
they are not part of any execution flow). With GCC's proposed automatic
stack variable initialization feature, this triggers a warning (and they
don't get initialized). Clang's automatic stack variable initialization
(via CONFIG_INIT_STACK_ALL=y) doesn't throw a warning, but it also
doesn't initialize such variables[1]. Note that these warnings (or silent
skipping) happen before the dead-store elimination optimization phase,
so even when the automatic initializations are later elided in favor of
direct initializations, the warnings remain.

To avoid these problems, move such variables into the "case" where
they're used or lift them up into the main function body.

net/core/skbuff.c: In function ‘skb_checksum_setup_ip’:
net/core/skbuff.c:4809:7: warning: statement will never be executed [-Wswitch-unreachable]
 4809 |   int err;
      |       ^~~

[1] https://bugs.llvm.org/show_bug.cgi?id=44916

Signed-off-by: Kees Cook 
Signed-off-by: David S. Miller

skbuff: remove stale bit mask comments

2020-02-17T03:49:51+00:00

Remove stale comments since this flag is no longer a bit mask
but is a bit field.

Signed-off-by: Randy Dunlap 
Signed-off-by: David S. Miller

net: Support GRO/GSO fraglist chaining.

2020-01-27T10:00:21+00:00

This patch adds the core functions to chain/unchain
GSO skbs at the frag_list pointer. This also adds
a new GSO type SKB_GSO_FRAGLIST and a is_flist
flag to napi_gro_cb which indicates that this
flow will be GROed by fraglist chaining.

Signed-off-by: Steffen Klassert 
Reviewed-by: Willem de Bruijn 
Signed-off-by: David S. Miller

skb: add helpers to allocate ext independently from sk_buff

2020-01-10T02:41:42+00:00

Currently we can allocate the extension only after the skb,
this change allows the user to do the opposite, will simplify
allocation failure handling from MPTCP.

Signed-off-by: Paolo Abeni 
Signed-off-by: Mat Martineau 
Signed-off-by: David S. Miller

mptcp: Add MPTCP to skb extensions

2020-01-10T02:41:41+00:00

Add enum value for MPTCP and update config dependencies

v5 -> v6:
 - fixed '__unused' field size

Co-developed-by: Matthieu Baerts 
Signed-off-by: Matthieu Baerts 
Co-developed-by: Paolo Abeni 
Signed-off-by: Paolo Abeni 
Signed-off-by: Mat Martineau 
Signed-off-by: David S. Miller

net: Rephrased comments section of skb_mpls_pop()

2019-12-25T06:24:45+00:00

Rephrased comments section of skb_mpls_pop() to align it with
comments section of skb_mpls_push().

Signed-off-by: Martin Varghese 
Acked-by: Pravin B Shelar 
Signed-off-by: David S. Miller

net: skb_mpls_push() modified to allow MPLS header push at start of packet.

2019-12-25T06:24:45+00:00

The existing skb_mpls_push() implementation always inserts mpls header
after the mac header. L2 VPN use cases requires MPLS header to be
inserted before the ethernet header as the ethernet packet gets tunnelled
inside MPLS header in those cases.

Signed-off-by: Martin Varghese 
Acked-by: Pravin B Shelar 
Signed-off-by: David S. Miller

net: Fixed updating of ethertype in skb_mpls_push()

2019-12-05T01:11:25+00:00

The skb_mpls_push was not updating ethertype of an ethernet packet if
the packet was originally received from a non ARPHRD_ETHER device.

In the below OVS data path flow, since the device corresponding to
port 7 is an l3 device (ARPHRD_NONE) the skb_mpls_push function does
not update the ethertype of the packet even though the previous
push_eth action had added an ethernet header to the packet.

recirc_id(0),in_port(7),eth_type(0x0800),ipv4(tos=0/0xfc,ttl=64,frag=no),
actions:push_eth(src=00:00:00:00:00:00,dst=00:00:00:00:00:00),
push_mpls(label=13,tc=0,ttl=64,bos=1,eth_type=0x8847),4

Fixes: 8822e270d697 ("net: core: move push MPLS functionality from OvS to core helper")
Signed-off-by: Martin Varghese 
Signed-off-by: David S. Miller

Fixed updating of ethertype in function skb_mpls_pop

2019-12-02T21:03:50+00:00

The skb_mpls_pop was not updating ethertype of an ethernet packet if the
packet was originally received from a non ARPHRD_ETHER device.

In the below OVS data path flow, since the device corresponding to port 7
is an l3 device (ARPHRD_NONE) the skb_mpls_pop function does not update
the ethertype of the packet even though the previous push_eth action had
added an ethernet header to the packet.

recirc_id(0),in_port(7),eth_type(0x8847),
mpls(label=12/0xfffff,tc=0/0,ttl=0/0x0,bos=1/1),
actions:push_eth(src=00:00:00:00:00:00,dst=00:00:00:00:00:00),
pop_mpls(eth_type=0x800),4

Fixes: ed246cee09b9 ("net: core: move pop MPLS functionality from OvS to core helper")
Signed-off-by: Martin Varghese 
Acked-by: Pravin B Shelar 
Signed-off-by: David S. Miller