FW: Re: [PATCH v3 4/4] packet: Add pre-defragmentation support for ipv4

+static struct sk_buff *fanout_check_defrag(struct sk_buff *skb)
+{
+	const struct iphdr *iph;
+	u32 len;
+
+	if (skb->protocol != htons(ETH_P_IP))
+		return skb;
+
+	if (!pskb_may_pull(skb, sizeof(struct iphdr)))
+		return skb;
+
+	iph = ip_hdr(skb);
+	if (iph->ihl < 5 || iph->version != 4)
+		return skb;
+	if (!pskb_may_pull(skb, iph->ihl*4))
+		return skb;
+	iph = ip_hdr(skb);
+	len = ntohs(iph->tot_len);
+	if (skb->len < len || len < (iph->ihl * 4))
+		return skb;
+
+	if (ip_is_fragment(ip_hdr(skb))) {
+		skb = skb_clone(skb, GFP_ATOMIC);

Isn't this leaking the original skb?

+		if (skb) {
+			if (pskb_trim_rcsum(skb, len))
+				return skb;
+			memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
+			if (ip_defrag(skb, IP_DEFRAG_AF_PACKET))
+				return NULL;
+			skb->rxhash = 0;
+		}
+	}
+	return skb;
+}

-Mika

Le mercredi 06 juillet 2011 à 14:06 +0000, Penttilä Mika a écrit :

quoted

+static struct sk_buff *fanout_check_defrag(struct sk_buff *skb)
+{
+	const struct iphdr *iph;
+	u32 len;
+
+	if (skb->protocol != htons(ETH_P_IP))
+		return skb;
+
+	if (!pskb_may_pull(skb, sizeof(struct iphdr)))
+		return skb;
+
+	iph = ip_hdr(skb);
+	if (iph->ihl < 5 || iph->version != 4)
+		return skb;
+	if (!pskb_may_pull(skb, iph->ihl*4))
+		return skb;
+	iph = ip_hdr(skb);
+	len = ntohs(iph->tot_len);
+	if (skb->len < len || len < (iph->ihl * 4))
+		return skb;
+
+	if (ip_is_fragment(ip_hdr(skb))) {
+		skb = skb_clone(skb, GFP_ATOMIC);

Isn't this leaking the original skb?

Yes, there are several problems here.

More fundamentally, there is a problem if two (or more) applications use
FANOUT sockets.

Only one will get the defragmented packet.

We probably need to have separate frag lists, or adding/using skb->sk as
a key.

Thanks


[PATCH] packet: fix a leak in fanout_check_defrag()

Reported-by: Penttilä Mika <redacted>
Signed-off-by: Eric Dumazet <redacted>
---
 net/packet/af_packet.c |   21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 41f0489..69238f6 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c

@@ -476,15 +476,20 @@ static struct sk_buff *fanout_check_defrag(struct sk_buff *skb)
 		return skb;
 
 	if (ip_is_fragment(ip_hdr(skb))) {
-		skb = skb_clone(skb, GFP_ATOMIC);
-		if (skb) {
-			if (pskb_trim_rcsum(skb, len))
-				return skb;
-			memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
-			if (ip_defrag(skb, IP_DEFRAG_AF_PACKET))
-				return NULL;
-			skb->rxhash = 0;
+		struct sk_buff *nskb = skb_clone(skb, GFP_ATOMIC);
+
+		if (!nskb)
+			return skb;
+		if (pskb_trim_rcsum(nskb, len)) {
+			kfree_skb(nskb);
+			return skb;
 		}
+		kfree_skb(skb);
+		skb = nskb;
+		memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
+		if (ip_defrag(skb, IP_DEFRAG_AF_PACKET))
+			return NULL;
+		skb->rxhash = 0;
 	}
 	return skb;
 }

From: Eric Dumazet <redacted>
Date: Wed, 06 Jul 2011 17:18:09 +0200

[PATCH] packet: fix a leak in fanout_check_defrag()

Reported-by: Penttilä Mika <redacted>
Signed-off-by: Eric Dumazet <redacted>

Eric, see what I commited, it's much simpler than all
of this code movement you added, ala skb_share_check()
:-)

Le mercredi 06 juillet 2011 à 08:20 -0700, David Miller a écrit :

From: Eric Dumazet <redacted>
Date: Wed, 06 Jul 2011 17:18:09 +0200

quoted

[PATCH] packet: fix a leak in fanout_check_defrag()

Reported-by: Penttilä Mika <redacted>
Signed-off-by: Eric Dumazet <redacted>

Eric, see what I commited, it's much simpler than all
of this code movement you added, ala skb_share_check()
:-)

I tried to not lose the original packet and let application catch it ;)

We probably need to add some atomic_inc(&sk->sk_drops) to at least warn
the application.

From: Eric Dumazet <redacted>
Date: Wed, 06 Jul 2011 17:27:57 +0200

We probably need to add some atomic_inc(&sk->sk_drops) to at least
warn the application.

I fully support adding some kind of statistics support to AF_PACKET
sockets.