linux-stable.git/net/ipv4/ip_output.c, branch v3.2.55

inet: fix possible memory corruption with UDP_CORK and UFO

2013-11-28T14:01:59+00:00

[ This is a simplified -stable version of a set of upstream commits. ]

This is a replacement patch only for stable which does fix the problems
handled by the following two commits in -net:

"ip_output: do skb ufo init for peeked non ufo skb as well" (e93b7d748be887cd7639b113ba7d7ef792a7efb9)
"ip6_output: do skb ufo init for peeked non ufo skb as well" (c547dbf55d5f8cf615ccc0e7265e98db27d3fb8b)

Three frames are written on a corked udp socket for which the output
netdevice has UFO enabled.  If the first and third frame are smaller than
the mtu and the second one is bigger, we enqueue the second frame with
skb_append_datato_frags without initializing the gso fields. This leads
to the third frame appended regulary and thus constructing an invalid skb.

This fixes the problem by always using skb_append_datato_frags as soon
as the first frag got enqueued to the skb without marking the packet
as SKB_GSO_UDP.

The problem with only two frames for ipv6 was fixed by "ipv6: udp
packets following an UFO enqueued packet need also be handled by UFO"
(2811ebac2521ceac84f2bdae402455baa6a7fb47).

Cc: Jiri Pirko 
Cc: Eric Dumazet 
Cc: David Miller 
Signed-off-by: Hannes Frederic Sowa 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings

ip: generate unique IP identificator if local fragmentation is allowed

2013-10-26T20:06:08+00:00

[ Upstream commit 703133de331a7a7df47f31fb9de51dc6f68a9de8 ]

If local fragmentation is allowed, then ip_select_ident() and
ip_select_ident_more() need to generate unique IDs to ensure
correct defragmentation on the peer.

For example, if IPsec (tunnel mode) has to encrypt large skbs
that have local_df bit set, then all IP fragments that belonged
to different ESP datagrams would have used the same identificator.
If one of these IP fragments would get lost or reordered, then
peer could possibly stitch together wrong IP fragments that did
not belong to the same datagram. This would lead to a packet loss
or data corruption.

Signed-off-by: Ansis Atteka 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings

ipv4: tcp: fix TOS value in ACK messages sent from TIME_WAIT

2011-10-24T07:06:21+00:00

There is a long standing bug in linux tcp stack, about ACK messages sent
on behalf of TIME_WAIT sockets.

In the IP header of the ACK message, we choose to reflect TOS field of
incoming message, and this might break some setups.

Example of things that were broken :
  - Routing using TOS as a selector
  - Firewalls
  - Trafic classification / shaping

We now remember in timewait structure the inet tos field and use it in
ACK generation, and route lookup.

Notes :
 - We still reflect incoming TOS in RST messages.
 - We could extend MuraliRaja Muniraju patch to report TOS value in
netlink messages for TIME_WAIT sockets.
 - A patch is needed for IPv6

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

net: add skb frag size accessors

2011-10-19T07:10:46+00:00

To ease skb->truesize sanitization, its better to be able to localize
all references to skb frags size.

Define accessors : skb_frag_size() to fetch frag size, and
skb_frag_size_{set|add|sub}() to manipulate it.

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

net: ipv4: convert to SKB frag APIs

2011-08-25T00:52:11+00:00

Signed-off-by: Ian Campbell 
Cc: "David S. Miller" 
Cc: Alexey Kuznetsov 
Cc: "Pekka Savola (ipv6)" 
Cc: James Morris 
Cc: Hideaki YOSHIFUJI 
Cc: Patrick McHardy 
Cc: netdev@vger.kernel.org
Signed-off-by: David S. Miller

ipv4: use dst with ref during bcast/mcast loopback

2011-08-08T05:52:32+00:00

Make sure skb dst has reference when moving to
another context. Currently, I don't see protocols that can
hit it when sending broadcasts/multicasts to loopback using
noref dsts, so it is just a precaution.

Signed-off-by: Julian Anastasov 
Signed-off-by: David S. Miller

net: fix NULL dereferences in check_peer_redir()

2011-08-03T10:34:12+00:00

Gergely Kalman reported crashes in check_peer_redir().

It appears commit f39925dbde778 (ipv4: Cache learned redirect
information in inetpeer.) added a race, leading to possible NULL ptr
dereference.

Since we can now change dst neighbour, we should make sure a reader can
safely use a neighbour.

Add RCU protection to dst neighbour, and make sure check_peer_redir()
can be called safely by different cpus in parallel.

As neighbours are already freed after one RCU grace period, this patch
should not add typical RCU penalty (cache cold effects)

Many thanks to Gergely for providing a pretty report pointing to the
bug.

Reported-by: Gergely Kalman 
Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

ipv4: Constrain UFO fragment sizes to multiples of 8 bytes

2011-07-22T04:31:41+00:00

Because the ip fragment offset field counts 8-byte chunks, ip
fragments other than the last must contain a multiple of 8 bytes of
payload.  ip_ufo_append_data wasn't respecting this constraint and,
depending on the MTU and ip option sizes, could create malformed
non-final fragments.

Google-Bug-Id: 5009328
Signed-off-by: Bill Sommerfeld 
Signed-off-by: David S. Miller

net: Abstract dst->neighbour accesses behind helpers.

2011-07-18T06:11:35+00:00

dst_{get,set}_neighbour()

Signed-off-by: David S. Miller

net: Create and use new helper, neigh_output().

2011-07-17T00:26:00+00:00

Signed-off-by: David S. Miller