Commit 7938cd15 authored by Richard Gobert's avatar Richard Gobert Committed by David S. Miller
Browse files

net: gro: fix misuse of CB in udp socket lookup 



This patch fixes a misuse of IP{6}CB(skb) in GRO, while calling to
`udp6_lib_lookup2` when handling udp tunnels. `udp6_lib_lookup2` fetch the
device from CB. The fix changes it to fetch the device from `skb->dev`.
l3mdev case requires special attention since it has a master and a slave
device.

Fixes: a6024562 ("udp: Add GRO functions to UDP socket")
Reported-by: default avatarGal Pressman <gal@nvidia.com>
Signed-off-by: default avatarRichard Gobert <richardbgobert@gmail.com>
Reviewed-by: default avatarDavid Ahern <dsahern@kernel.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent e346e231

include/net/gro.h

+43 −0
Original line number Diff line number Diff line
@@ -452,6 +452,49 @@ static inline void gro_normal_one(struct napi_struct *napi, struct sk_buff *skb, 
		gro_normal_list(napi);

}



/* This function is the alternative of 'inet_iif' and 'inet_sdif'

 * functions in case we can not rely on fields of IPCB.

 *

 * The caller must verify skb_valid_dst(skb) is false and skb->dev is initialized.

 * The caller must hold the RCU read lock.

 */

static inline void inet_get_iif_sdif(const struct sk_buff *skb, int *iif, int *sdif)

{

	*iif = inet_iif(skb) ?: skb->dev->ifindex;

	*sdif = 0;



#if IS_ENABLED(CONFIG_NET_L3_MASTER_DEV)

	if (netif_is_l3_slave(skb->dev)) {

		struct net_device *master = netdev_master_upper_dev_get_rcu(skb->dev);



		*sdif = *iif;

		*iif = master ? master->ifindex : 0;

	}

#endif

}



/* This function is the alternative of 'inet6_iif' and 'inet6_sdif'

 * functions in case we can not rely on fields of IP6CB.

 *

 * The caller must verify skb_valid_dst(skb) is false and skb->dev is initialized.

 * The caller must hold the RCU read lock.

 */

static inline void inet6_get_iif_sdif(const struct sk_buff *skb, int *iif, int *sdif)

{

	/* using skb->dev->ifindex because skb_dst(skb) is not initialized */

	*iif = skb->dev->ifindex;

	*sdif = 0;



#if IS_ENABLED(CONFIG_NET_L3_MASTER_DEV)

	if (netif_is_l3_slave(skb->dev)) {

		struct net_device *master = netdev_master_upper_dev_get_rcu(skb->dev);



		*sdif = *iif;

		*iif = master ? master->ifindex : 0;

	}

#endif

}



extern struct list_head offload_base;



#endif /* _NET_IPV6_GRO_H */

net/ipv4/udp.c

+6 −2
Original line number Diff line number Diff line
@@ -114,6 +114,7 @@ 
#include <net/sock_reuseport.h>

#include <net/addrconf.h>

#include <net/udp_tunnel.h>

#include <net/gro.h>

#if IS_ENABLED(CONFIG_IPV6)

#include <net/ipv6_stubs.h>

#endif
@@ -555,10 +556,13 @@ struct sock *udp4_lib_lookup_skb(const struct sk_buff *skb, 
{

	const struct iphdr *iph = ip_hdr(skb);

	struct net *net = dev_net(skb->dev);

	int iif, sdif;



	inet_get_iif_sdif(skb, &iif, &sdif);



	return __udp4_lib_lookup(net, iph->saddr, sport,

				 iph->daddr, dport, inet_iif(skb),

				 inet_sdif(skb), net->ipv4.udp_table, NULL);

				 iph->daddr, dport, iif,

				 sdif, net->ipv4.udp_table, NULL);

}



/* Must be called under rcu_read_lock().

net/ipv4/udp_offload.c

+5 −2
Original line number Diff line number Diff line
@@ -609,10 +609,13 @@ static struct sock *udp4_gro_lookup_skb(struct sk_buff *skb, __be16 sport, 
{

	const struct iphdr *iph = skb_gro_network_header(skb);

	struct net *net = dev_net(skb->dev);

	int iif, sdif;



	inet_get_iif_sdif(skb, &iif, &sdif);



	return __udp4_lib_lookup(net, iph->saddr, sport,

				 iph->daddr, dport, inet_iif(skb),

				 inet_sdif(skb), net->ipv4.udp_table, NULL);

				 iph->daddr, dport, iif,

				 sdif, net->ipv4.udp_table, NULL);

}



INDIRECT_CALLABLE_SCOPE

net/ipv6/udp.c

+6 −2
Original line number Diff line number Diff line
@@ -51,6 +51,7 @@ 
#include <net/inet6_hashtables.h>

#include <net/busy_poll.h>

#include <net/sock_reuseport.h>

#include <net/gro.h>



#include <linux/proc_fs.h>

#include <linux/seq_file.h>
@@ -300,10 +301,13 @@ struct sock *udp6_lib_lookup_skb(const struct sk_buff *skb, 
{

	const struct ipv6hdr *iph = ipv6_hdr(skb);

	struct net *net = dev_net(skb->dev);

	int iif, sdif;



	inet6_get_iif_sdif(skb, &iif, &sdif);



	return __udp6_lib_lookup(net, &iph->saddr, sport,

				 &iph->daddr, dport, inet6_iif(skb),

				 inet6_sdif(skb), net->ipv4.udp_table, NULL);

				 &iph->daddr, dport, iif,

				 sdif, net->ipv4.udp_table, NULL);

}



/* Must be called under rcu_read_lock().

net/ipv6/udp_offload.c

+5 −2
Original line number Diff line number Diff line
@@ -118,10 +118,13 @@ static struct sock *udp6_gro_lookup_skb(struct sk_buff *skb, __be16 sport, 
{

	const struct ipv6hdr *iph = skb_gro_network_header(skb);

	struct net *net = dev_net(skb->dev);

	int iif, sdif;



	inet6_get_iif_sdif(skb, &iif, &sdif);



	return __udp6_lib_lookup(net, &iph->saddr, sport,

				 &iph->daddr, dport, inet6_iif(skb),

				 inet6_sdif(skb), net->ipv4.udp_table, NULL);

				 &iph->daddr, dport, iif,

				 sdif, net->ipv4.udp_table, NULL);

}



INDIRECT_CALLABLE_SCOPE