diff mbox

FW: Re: [PATCH v3 4/4] packet: Add pre-defragmentation support for ipv4

Message ID 1309965489.2292.27.camel@edumazet-HP-Compaq-6005-Pro-SFF-PC
State Not Applicable, archived
Delegated to: David Miller
Headers show

Commit Message

Eric Dumazet July 6, 2011, 3:18 p.m. UTC 
Le mercredi 06 juillet 2011 à 14:06 +0000, Penttilä Mika a écrit :
> 
> > +static struct sk_buff *fanout_check_defrag(struct sk_buff *skb)
> > +{
> > +	const struct iphdr *iph;
> > +	u32 len;
> > +
> > +	if (skb->protocol != htons(ETH_P_IP))
> > +		return skb;
> > +
> > +	if (!pskb_may_pull(skb, sizeof(struct iphdr)))
> > +		return skb;
> > +
> > +	iph = ip_hdr(skb);
> > +	if (iph->ihl < 5 || iph->version != 4)
> > +		return skb;
> > +	if (!pskb_may_pull(skb, iph->ihl*4))
> > +		return skb;
> > +	iph = ip_hdr(skb);
> > +	len = ntohs(iph->tot_len);
> > +	if (skb->len < len || len < (iph->ihl * 4))
> > +		return skb;
> > +
> > +	if (ip_is_fragment(ip_hdr(skb))) {
> > +		skb = skb_clone(skb, GFP_ATOMIC);
> 
> Isn't this leaking the original skb?

Yes, there are several problems here.

More fundamentally, there is a problem if two (or more) applications use
FANOUT sockets.

Only one will get the defragmented packet.

We probably need to have separate frag lists, or adding/using skb->sk as
a key.

Thanks


[PATCH] packet: fix a leak in fanout_check_defrag()

Reported-by: Penttilä Mika <mika.penttila@ixonos.com>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
---
 net/packet/af_packet.c |   21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)



--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Comments

David Miller July 6, 2011, 3:20 p.m. UTC | #1 
From: Eric Dumazet <eric.dumazet@gmail.com>
Date: Wed, 06 Jul 2011 17:18:09 +0200

> [PATCH] packet: fix a leak in fanout_check_defrag()
> 
> Reported-by: Penttilä Mika <mika.penttila@ixonos.com>
> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>

Eric, see what I commited, it's much simpler than all
of this code movement you added, ala skb_share_check()
:-)
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Eric Dumazet July 6, 2011, 3:27 p.m. UTC | #2 
Le mercredi 06 juillet 2011 à 08:20 -0700, David Miller a écrit :
> From: Eric Dumazet <eric.dumazet@gmail.com>
> Date: Wed, 06 Jul 2011 17:18:09 +0200
> 
> > [PATCH] packet: fix a leak in fanout_check_defrag()
> > 
> > Reported-by: Penttilä Mika <mika.penttila@ixonos.com>
> > Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
> 
> Eric, see what I commited, it's much simpler than all
> of this code movement you added, ala skb_share_check()
> :-)

I tried to not lose the original packet and let application catch it ;)

We probably need to add some atomic_inc(&sk->sk_drops) to at least warn
the application.



--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
David Miller July 7, 2011, 7:25 a.m. UTC | #3 
From: Eric Dumazet <eric.dumazet@gmail.com>
Date: Wed, 06 Jul 2011 17:27:57 +0200

> We probably need to add some atomic_inc(&sk->sk_drops) to at least
> warn the application.

I fully support adding some kind of statistics support to AF_PACKET
sockets.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 41f0489..69238f6 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -476,15 +476,20 @@  static struct sk_buff *fanout_check_defrag(struct sk_buff *skb)
 		return skb;
 
 	if (ip_is_fragment(ip_hdr(skb))) {
-		skb = skb_clone(skb, GFP_ATOMIC);
-		if (skb) {
-			if (pskb_trim_rcsum(skb, len))
-				return skb;
-			memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
-			if (ip_defrag(skb, IP_DEFRAG_AF_PACKET))
-				return NULL;
-			skb->rxhash = 0;
+		struct sk_buff *nskb = skb_clone(skb, GFP_ATOMIC);
+
+		if (!nskb)
+			return skb;
+		if (pskb_trim_rcsum(nskb, len)) {
+			kfree_skb(nskb);
+			return skb;
 		}
+		kfree_skb(skb);
+		skb = nskb;
+		memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
+		if (ip_defrag(skb, IP_DEFRAG_AF_PACKET))
+			return NULL;
+		skb->rxhash = 0;
 	}
 	return skb;
 }