Commit 5ef31ea5 authored by Richard Gobert's avatar Richard Gobert Committed by Paolo Abeni
Browse files

net: gro: fix udp bad offset in socket lookup by adding {inner_}network_offset to napi_gro_cb 



Commits a6024562 ("udp: Add GRO functions to UDP socket") and 57c67ff4 ("udp:
additional GRO support") introduce incorrect usage of {ip,ipv6}_hdr in the
complete phase of gro. The functions always return skb->network_header,
which in the case of encapsulated packets at the gro complete phase, is
always set to the innermost L3 of the packet. That means that calling
{ip,ipv6}_hdr for skbs which completed the GRO receive phase (both in
gro_list and *_gro_complete) when parsing an encapsulated packet's _outer_
L3/L4 may return an unexpected value.

This incorrect usage leads to a bug in GRO's UDP socket lookup.
udp{4,6}_lib_lookup_skb functions use ip_hdr/ipv6_hdr respectively. These
*_hdr functions return network_header which will point to the innermost L3,
resulting in the wrong offset being used in __udp{4,6}_lib_lookup with
encapsulated packets.

This patch adds network_offset and inner_network_offset to napi_gro_cb, and
makes sure both are set correctly.

To fix the issue, network_offsets union is used inside napi_gro_cb, in
which both the outer and the inner network offsets are saved.

Reproduction example:

Endpoint configuration example (fou + local address bind)

    # ip fou add port 6666 ipproto 4
    # ip link add name tun1 type ipip remote 2.2.2.1 local 2.2.2.2 encap fou encap-dport 5555 encap-sport 6666 mode ipip
    # ip link set tun1 up
    # ip a add 1.1.1.2/24 dev tun1

Netperf TCP_STREAM result on net-next before patch is applied:

net-next main, GRO enabled:
    $ netperf -H 1.1.1.2 -t TCP_STREAM -l 5
    Recv   Send    Send
    Socket Socket  Message  Elapsed
    Size   Size    Size     Time     Throughput
    bytes  bytes   bytes    secs.    10^6bits/sec

    131072  16384  16384    5.28        2.37

net-next main, GRO disabled:
    $ netperf -H 1.1.1.2 -t TCP_STREAM -l 5
    Recv   Send    Send
    Socket Socket  Message  Elapsed
    Size   Size    Size     Time     Throughput
    bytes  bytes   bytes    secs.    10^6bits/sec

    131072  16384  16384    5.01     2745.06

patch applied, GRO enabled:
    $ netperf -H 1.1.1.2 -t TCP_STREAM -l 5
    Recv   Send    Send
    Socket Socket  Message  Elapsed
    Size   Size    Size     Time     Throughput
    bytes  bytes   bytes    secs.    10^6bits/sec

    131072  16384  16384    5.01     2877.38

Fixes: a6024562 ("udp: Add GRO functions to UDP socket")
Signed-off-by: default avatarRichard Gobert <richardbgobert@gmail.com>
Reviewed-by: default avatarEric Dumazet <edumazet@google.com>
Reviewed-by: default avatarWillem de Bruijn <willemb@google.com>
Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
parent fc1092f5

include/net/gro.h

+9 −0
Original line number Diff line number Diff line
@@ -87,6 +87,15 @@ struct napi_gro_cb { 


	/* used to support CHECKSUM_COMPLETE for tunneling protocols */

	__wsum	csum;



	/* L3 offsets */

	union {

		struct {

			u16 network_offset;

			u16 inner_network_offset;

		};

		u16 network_offsets[2];

	};

};



#define NAPI_GRO_CB(skb) ((struct napi_gro_cb *)(skb)->cb)

net/8021q/vlan_core.c

+2 −0
Original line number Diff line number Diff line
@@ -478,6 +478,8 @@ static struct sk_buff *vlan_gro_receive(struct list_head *head, 
	if (unlikely(!vhdr))

		goto out;



	NAPI_GRO_CB(skb)->network_offsets[NAPI_GRO_CB(skb)->encap_mark] = hlen;



	type = vhdr->h_vlan_encapsulated_proto;



	ptype = gro_find_receive_by_type(type);

net/core/gro.c

+1 −0
Original line number Diff line number Diff line
@@ -371,6 +371,7 @@ static inline void skb_gro_reset_offset(struct sk_buff *skb, u32 nhoff) 
	const skb_frag_t *frag0;

	unsigned int headlen;



	NAPI_GRO_CB(skb)->network_offset = 0;

	NAPI_GRO_CB(skb)->data_offset = 0;

	headlen = skb_headlen(skb);

	NAPI_GRO_CB(skb)->frag0 = skb->data;

net/ipv4/af_inet.c

+1 −0
Original line number Diff line number Diff line
@@ -1572,6 +1572,7 @@ struct sk_buff *inet_gro_receive(struct list_head *head, struct sk_buff *skb) 
	/* The above will be needed by the transport layer if there is one

	 * immediately following this IP hdr.

	 */

	NAPI_GRO_CB(skb)->inner_network_offset = off;



	/* Note : No need to call skb_gro_postpull_rcsum() here,

	 * as we already checked checksum over ipv4 header was 0

net/ipv4/udp.c

+2 −1
Original line number Diff line number Diff line
@@ -532,7 +532,8 @@ static inline struct sock *__udp4_lib_lookup_skb(struct sk_buff *skb, 
struct sock *udp4_lib_lookup_skb(const struct sk_buff *skb,

				 __be16 sport, __be16 dport)

{

	const struct iphdr *iph = ip_hdr(skb);

	const u16 offset = NAPI_GRO_CB(skb)->network_offsets[skb->encapsulation];

	const struct iphdr *iph = (struct iphdr *)(skb->data + offset);

	struct net *net = dev_net(skb->dev);

	int iif, sdif;