target/linux/generic/backport-6.6/600-v6.9-02-net-gro-fix-udp-bad-offset-in-socket-lookup-by-addin.patch

   1 From: Richard Gobert <richardbgobert@gmail.com>
   2 Date: Tue, 30 Apr 2024 16:35:54 +0200
   3 Subject: [PATCH] net: gro: fix udp bad offset in socket lookup by adding
   4  {inner_}network_offset to napi_gro_cb
   5
   6 Commits a602456 ("udp: Add GRO functions to UDP socket") and 57c67ff ("udp:
   7 additional GRO support") introduce incorrect usage of {ip,ipv6}_hdr in the
   8 complete phase of gro. The functions always return skb->network_header,
   9 which in the case of encapsulated packets at the gro complete phase, is
  10 always set to the innermost L3 of the packet. That means that calling
  11 {ip,ipv6}_hdr for skbs which completed the GRO receive phase (both in
  12 gro_list and *_gro_complete) when parsing an encapsulated packet's _outer_
  13 L3/L4 may return an unexpected value.
  14
  15 This incorrect usage leads to a bug in GRO's UDP socket lookup.
  16 udp{4,6}_lib_lookup_skb functions use ip_hdr/ipv6_hdr respectively. These
  17 *_hdr functions return network_header which will point to the innermost L3,
  18 resulting in the wrong offset being used in __udp{4,6}_lib_lookup with
  19 encapsulated packets.
  20
  21 This patch adds network_offset and inner_network_offset to napi_gro_cb, and
  22 makes sure both are set correctly.
  23
  24 To fix the issue, network_offsets union is used inside napi_gro_cb, in
  25 which both the outer and the inner network offsets are saved.
  26
  27 Reproduction example:
  28
  29 Endpoint configuration example (fou + local address bind)
  30
  31     # ip fou add port 6666 ipproto 4
  32     # ip link add name tun1 type ipip remote 2.2.2.1 local 2.2.2.2 encap fou encap-dport 5555 encap-sport 6666 mode ipip
  33     # ip link set tun1 up
  34     # ip a add 1.1.1.2/24 dev tun1
  35
  36 Netperf TCP_STREAM result on net-next before patch is applied:
  37
  38 net-next main, GRO enabled:
  39     $ netperf -H 1.1.1.2 -t TCP_STREAM -l 5
  40     Recv   Send    Send
  41     Socket Socket  Message  Elapsed
  42     Size   Size    Size     Time     Throughput
  43     bytes  bytes   bytes    secs.    10^6bits/sec
  44
  45     131072  16384  16384    5.28        2.37
  46
  47 net-next main, GRO disabled:
  48     $ netperf -H 1.1.1.2 -t TCP_STREAM -l 5
  49     Recv   Send    Send
  50     Socket Socket  Message  Elapsed
  51     Size   Size    Size     Time     Throughput
  52     bytes  bytes   bytes    secs.    10^6bits/sec
  53
  54     131072  16384  16384    5.01     2745.06
  55
  56 patch applied, GRO enabled:
  57     $ netperf -H 1.1.1.2 -t TCP_STREAM -l 5
  58     Recv   Send    Send
  59     Socket Socket  Message  Elapsed
  60     Size   Size    Size     Time     Throughput
  61     bytes  bytes   bytes    secs.    10^6bits/sec
  62
  63     131072  16384  16384    5.01     2877.38
  64
  65 Fixes: a6024562ffd7 ("udp: Add GRO functions to UDP socket")
  66 Signed-off-by: Richard Gobert <richardbgobert@gmail.com>
  67 Reviewed-by: Eric Dumazet <edumazet@google.com>
  68 Reviewed-by: Willem de Bruijn <willemb@google.com>
  69 Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  70 ---
  71
  72 --- a/include/net/gro.h
  73 +++ b/include/net/gro.h
  74 @@ -86,6 +86,15 @@ struct napi_gro_cb {
  75
  76         /* used to support CHECKSUM_COMPLETE for tunneling protocols */
  77         __wsum  csum;
  78 +
  79 +       /* L3 offsets */
  80 +       union {
  81 +               struct {
  82 +                       u16 network_offset;
  83 +                       u16 inner_network_offset;
  84 +               };
  85 +               u16 network_offsets[2];
  86 +       };
  87  };
  88
  89  #define NAPI_GRO_CB(skb) ((struct napi_gro_cb *)(skb)->cb)
  90 --- a/net/8021q/vlan_core.c
  91 +++ b/net/8021q/vlan_core.c
  92 @@ -478,6 +478,8 @@ static struct sk_buff *vlan_gro_receive(
  93         if (unlikely(!vhdr))
  94                 goto out;
  95
  96 +       NAPI_GRO_CB(skb)->network_offsets[NAPI_GRO_CB(skb)->encap_mark] = hlen;
  97 +
  98         type = vhdr->h_vlan_encapsulated_proto;
  99
 100         ptype = gro_find_receive_by_type(type);
 101 --- a/net/core/gro.c
 102 +++ b/net/core/gro.c
 103 @@ -373,6 +373,7 @@ static inline void skb_gro_reset_offset(
 104         const struct skb_shared_info *pinfo = skb_shinfo(skb);
 105         const skb_frag_t *frag0 = &pinfo->frags[0];
 106
 107 +       NAPI_GRO_CB(skb)->network_offset = 0;
 108         NAPI_GRO_CB(skb)->data_offset = 0;
 109         NAPI_GRO_CB(skb)->frag0 = NULL;
 110         NAPI_GRO_CB(skb)->frag0_len = 0;
 111 --- a/net/ipv4/af_inet.c
 112 +++ b/net/ipv4/af_inet.c
 113 @@ -1571,6 +1571,7 @@ struct sk_buff *inet_gro_receive(struct
 114         /* The above will be needed by the transport layer if there is one
 115          * immediately following this IP hdr.
 116          */
 117 +       NAPI_GRO_CB(skb)->inner_network_offset = off;
 118
 119         /* Note : No need to call skb_gro_postpull_rcsum() here,
 120          * as we already checked checksum over ipv4 header was 0
 121 --- a/net/ipv4/udp.c
 122 +++ b/net/ipv4/udp.c
 123 @@ -534,7 +534,8 @@ static inline struct sock *__udp4_lib_lo
 124  struct sock *udp4_lib_lookup_skb(const struct sk_buff *skb,
 125                                  __be16 sport, __be16 dport)
 126  {
 127 -       const struct iphdr *iph = ip_hdr(skb);
 128 +       const u16 offset = NAPI_GRO_CB(skb)->network_offsets[skb->encapsulation];
 129 +       const struct iphdr *iph = (struct iphdr *)(skb->data + offset);
 130         struct net *net = dev_net(skb->dev);
 131         int iif, sdif;
 132
 133 --- a/net/ipv4/udp_offload.c
 134 +++ b/net/ipv4/udp_offload.c
 135 @@ -718,7 +718,8 @@ EXPORT_SYMBOL(udp_gro_complete);
 136
 137  INDIRECT_CALLABLE_SCOPE int udp4_gro_complete(struct sk_buff *skb, int nhoff)
 138  {
 139 -       const struct iphdr *iph = ip_hdr(skb);
 140 +       const u16 offset = NAPI_GRO_CB(skb)->network_offsets[skb->encapsulation];
 141 +       const struct iphdr *iph = (struct iphdr *)(skb->data + offset);
 142         struct udphdr *uh = (struct udphdr *)(skb->data + nhoff);
 143
 144         /* do fraglist only if there is no outer UDP encap (or we already processed it) */
 145 --- a/net/ipv6/ip6_offload.c
 146 +++ b/net/ipv6/ip6_offload.c
 147 @@ -240,6 +240,7 @@ INDIRECT_CALLABLE_SCOPE struct sk_buff *
 148                 goto out;
 149
 150         skb_set_network_header(skb, off);
 151 +       NAPI_GRO_CB(skb)->inner_network_offset = off;
 152
 153         flush += ntohs(iph->payload_len) != skb->len - hlen;
 154
 155 --- a/net/ipv6/udp.c
 156 +++ b/net/ipv6/udp.c
 157 @@ -275,7 +275,8 @@ static struct sock *__udp6_lib_lookup_sk
 158  struct sock *udp6_lib_lookup_skb(const struct sk_buff *skb,
 159                                  __be16 sport, __be16 dport)
 160  {
 161 -       const struct ipv6hdr *iph = ipv6_hdr(skb);
 162 +       const u16 offset = NAPI_GRO_CB(skb)->network_offsets[skb->encapsulation];
 163 +       const struct ipv6hdr *iph = (struct ipv6hdr *)(skb->data + offset);
 164         struct net *net = dev_net(skb->dev);
 165         int iif, sdif;
 166
 167 --- a/net/ipv6/udp_offload.c
 168 +++ b/net/ipv6/udp_offload.c
 169 @@ -164,7 +164,8 @@ flush:
 170
 171  INDIRECT_CALLABLE_SCOPE int udp6_gro_complete(struct sk_buff *skb, int nhoff)
 172  {
 173 -       const struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 174 +       const u16 offset = NAPI_GRO_CB(skb)->network_offsets[skb->encapsulation];
 175 +       const struct ipv6hdr *ipv6h = (struct ipv6hdr *)(skb->data + offset);
 176         struct udphdr *uh = (struct udphdr *)(skb->data + nhoff);
 177
 178         /* do fraglist only if there is no outer UDP encap (or we already processed it) */