Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Wed, 11 Nov 2020 20:45:38 +0000
To:     "David S. Miller" <davem@davemloft.net>,
        Jakub Kicinski <kuba@kernel.org>
From:   Alexander Lobakin <alobakin@pm.me>
Cc:     Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>,
        Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>,
        Paolo Abeni <pabeni@redhat.com>,
        Willem de Bruijn <willemb@google.com>,
        Steffen Klassert <steffen.klassert@secunet.com>,
        Alexander Lobakin <alobakin@pm.me>,
        Eric Dumazet <edumazet@google.com>, netdev@vger.kernel.org,
        linux-kernel@vger.kernel.org
Reply-To: Alexander Lobakin <alobakin@pm.me>
Subject: [PATCH v5 net 2/2] net: udp: fix IP header access and skb lookup on Fast/frag0 UDP GRO
Message-ID: <sc7E1N6fUafwmUSYAu3TKgH39kfjNK5WuUi0wng54@cp4-web-030.plabs.ch>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

udp{4,6}_lib_lookup_skb() use ip{,v6}_hdr() to get IP header of the
packet. While it's probably OK for non-frag0 paths, this helpers
will also point to junk on Fast/frag0 GRO when all headers are
located in frags. As a result, sk/skb lookup may fail or give wrong
results. To support both GRO modes, skb_gro_network_header() might
be used. To not modify original functions, add private versions of
udp{4,6}_lib_lookup_skb() only to perform correct sk lookups on GRO.

Present since the introduction of "application-level" UDP GRO
in 4.7-rc1.

Misc: replace totally unneeded ternaries with plain ifs.

Fixes: a6024562ffd7 ("udp: Add GRO functions to UDP socket")
Suggested-by: Willem de Bruijn <willemb@google.com>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Alexander Lobakin <alobakin@pm.me>
---
 net/ipv4/udp_offload.c | 17 +++++++++++++++--
 net/ipv6/udp_offload.c | 17 +++++++++++++++--
 2 files changed, 30 insertions(+), 4 deletions(-)

diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
index 13740e9fe6ec..c62805cd3131 100644
--- a/net/ipv4/udp_offload.c
+++ b/net/ipv4/udp_offload.c
@@ -500,12 +500,22 @@ struct sk_buff *udp_gro_receive(struct list_head *hea=
d, struct sk_buff *skb,
 }
 EXPORT_SYMBOL(udp_gro_receive);
=20
+static struct sock *udp4_gro_lookup_skb(struct sk_buff *skb, __be16 sport,
+=09=09=09=09=09__be16 dport)
+{
+=09const struct iphdr *iph =3D skb_gro_network_header(skb);
+
+=09return __udp4_lib_lookup(dev_net(skb->dev), iph->saddr, sport,
+=09=09=09=09 iph->daddr, dport, inet_iif(skb),
+=09=09=09=09 inet_sdif(skb), &udp_table, NULL);
+}
+
 INDIRECT_CALLABLE_SCOPE
 struct sk_buff *udp4_gro_receive(struct list_head *head, struct sk_buff *s=
kb)
 {
 =09struct udphdr *uh =3D udp_gro_udphdr(skb);
+=09struct sock *sk =3D NULL;
 =09struct sk_buff *pp;
-=09struct sock *sk;
=20
 =09if (unlikely(!uh))
 =09=09goto flush;
@@ -523,7 +533,10 @@ struct sk_buff *udp4_gro_receive(struct list_head *hea=
d, struct sk_buff *skb)
 skip:
 =09NAPI_GRO_CB(skb)->is_ipv6 =3D 0;
 =09rcu_read_lock();
-=09sk =3D static_branch_unlikely(&udp_encap_needed_key) ? udp4_lib_lookup_=
skb(skb, uh->source, uh->dest) : NULL;
+
+=09if (static_branch_unlikely(&udp_encap_needed_key))
+=09=09sk =3D udp4_gro_lookup_skb(skb, uh->source, uh->dest);
+
 =09pp =3D udp_gro_receive(head, skb, uh, sk);
 =09rcu_read_unlock();
 =09return pp;
diff --git a/net/ipv6/udp_offload.c b/net/ipv6/udp_offload.c
index 584157a07759..f9e888d1b9af 100644
--- a/net/ipv6/udp_offload.c
+++ b/net/ipv6/udp_offload.c
@@ -111,12 +111,22 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_bu=
ff *skb,
 =09return segs;
 }
=20
+static struct sock *udp6_gro_lookup_skb(struct sk_buff *skb, __be16 sport,
+=09=09=09=09=09__be16 dport)
+{
+=09const struct ipv6hdr *iph =3D skb_gro_network_header(skb);
+
+=09return __udp6_lib_lookup(dev_net(skb->dev), &iph->saddr, sport,
+=09=09=09=09 &iph->daddr, dport, inet6_iif(skb),
+=09=09=09=09 inet6_sdif(skb), &udp_table, NULL);
+}
+
 INDIRECT_CALLABLE_SCOPE
 struct sk_buff *udp6_gro_receive(struct list_head *head, struct sk_buff *s=
kb)
 {
 =09struct udphdr *uh =3D udp_gro_udphdr(skb);
+=09struct sock *sk =3D NULL;
 =09struct sk_buff *pp;
-=09struct sock *sk;
=20
 =09if (unlikely(!uh))
 =09=09goto flush;
@@ -135,7 +145,10 @@ struct sk_buff *udp6_gro_receive(struct list_head *hea=
d, struct sk_buff *skb)
 skip:
 =09NAPI_GRO_CB(skb)->is_ipv6 =3D 1;
 =09rcu_read_lock();
-=09sk =3D static_branch_unlikely(&udpv6_encap_needed_key) ? udp6_lib_looku=
p_skb(skb, uh->source, uh->dest) : NULL;
+
+=09if (static_branch_unlikely(&udpv6_encap_needed_key))
+=09=09sk =3D udp6_gro_lookup_skb(skb, uh->source, uh->dest);
+
 =09pp =3D udp_gro_receive(head, skb, uh, sk);
 =09rcu_read_unlock();
 =09return pp;
--=20
2.29.2