Patch "udp: consistently apply ufo or fragmentation" has been added to the 4.9-stable tree
Subsystems (4)
This is a note to let you know that I've just added the patch titled
udp: consistently apply ufo or fragmentation
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
udp-consistently-apply-ufo-or-fragmentation.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.
Quoted 1 line
From foo@baz Fri Aug 11 09:20:24 PDT 2017
From: Willem de Bruijn <[email protected]>
Date: Thu, 10 Aug 2017 12:29:19 -0400
Subject: udp: consistently apply ufo or fragmentation
From: Willem de Bruijn <[email protected]>
[ Upstream commit 85f1bd9a7b5a79d5baa8bf44af19658f7bf77bfa ]
When iteratively building a UDP datagram with MSG_MORE and that datagram exceeds MTU, consistently choose UFO or fragmentation.
Once skb_is_gso, always apply ufo. Conversely, once a datagram is split across multiple skbs, do not consider ufo.
Sendpage already maintains the first invariant, only add the second. IPv6 does not have a sendpage implementation to modify.
A gso skb must have a partial checksum, do not follow sk_no_check_tx in udp_send_skb.
Found by syzkaller.
--- net/ipv4/ip_output.c | 7 +++++-- net/ipv4/udp.c | 2 +- net/ipv6/ip6_output.c | 7 ++++--- 3 files changed, 10 insertions(+), 6 deletions(-)
net/ipv4/ip_output.c +5 -2
@@ -936,10 +936,12 @@ static int __ip_append_data(struct sock csummode =CHECKSUM_PARTIAL ; cork->length += length; -if (((length > mtu) || (skb &&skb_is_gso (skb))) && +if ((skb &&skb_is_gso (skb)) || + ((length > mtu) && + (skb_queue_len (queue) <=1 ) && (sk->sk_protocol ==IPPROTO_UDP ) && (rt->dst.dev->features &NETIF_F_UFO ) && !rt->dst.header_len && - (sk->sk_type ==SOCK_DGRAM ) && !sk->sk_no_check_tx) { + (sk->sk_type ==SOCK_DGRAM ) && !sk->sk_no_check_tx)) { err =ip_ufo_append_data (sk, queue, getfrag, from, length, hh_len, fragheaderlen, transhdrlen, maxfraglen, flags);
@@ -1255,6 +1257,7 @@ ssize_t ip_append_page(struct sock *sk,return -EINVAL ;if ((size + skb->len > mtu) && + (skb_queue_len (&sk->sk_write_queue) ==1 ) && (sk->sk_protocol ==IPPROTO_UDP ) && (rt->dst.dev->features &NETIF_F_UFO )) {if (skb->ip_summed !=CHECKSUM_PARTIAL )
net/ipv4/udp.c +1 -1
@@ -813,7 +813,7 @@ static int udp_send_skb(struct sk_buff *if (is_udplite)/* UDP-Lite */ csum =udplite_csum (skb); -else if (sk->sk_no_check_tx) {/* UDP csum disabled */ +else if (sk->sk_no_check_tx && !skb_is_gso (skb)) {/* UDP csum off */ skb->ip_summed =CHECKSUM_NONE ; goto send;
net/ipv6/ip6_output.c +4 -3
@@ -1372,11 +1372,12 @@ emsgsize:*/ cork->length += length; -if ((((length + fragheaderlen) > mtu) || - (skb &&skb_is_gso (skb))) && +if ((skb &&skb_is_gso (skb)) || + (((length + fragheaderlen) > mtu) && + (skb_queue_len (queue) <=1 ) && (sk->sk_protocol ==IPPROTO_UDP ) && (rt->dst.dev->features &NETIF_F_UFO ) && !rt->dst.header_len && - (sk->sk_type ==SOCK_DGRAM ) && !udp_get_no_check6_tx (sk)) { + (sk->sk_type ==SOCK_DGRAM ) && !udp_get_no_check6_tx (sk))) { err =ip6_ufo_append_data (sk, queue, getfrag, from, length, hh_len, fragheaderlen, exthdrlen, transhdrlen, mtu, flags, fl6);
Patches currently in stable-queue which might be from [email protected] are
queue-4.9/net-avoid-skb_warn_bad_offload-false-positives-on-ufo.patch queue-4.9/packet-fix-tp_reserve-race-in-packet_set_ring.patch queue-4.9/udp-consistently-apply-ufo-or-fragmentation.patch