Commit cf204a71 authored by Shmulik Ladkani's avatar Shmulik Ladkani Committed by Daniel Borkmann
Browse files

bpf, testing: Introduce 'gso_linear_no_head_frag' skb_segment test 

Following reports of skb_segment() hitting a BUG_ON when working on
GROed skbs which have their gso_size mangled (e.g. after a
bpf_skb_change_proto call), add a reproducer test that mimics the
input skbs that lead to the mentioned BUG_ON as in [1] and validates the
fix submitted in [2].

[1] https://lists.openwall.net/netdev/2019/08/26/110


[2] commit 3dcbdb13 ("net: gso: Fix skb_segment splat when splitting gso_size mangled skb having linear-headed frag_list")

Signed-off-by: default avatarShmulik Ladkani <shmulik.ladkani@gmail.com>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20191025134223.2761-3-shmulik.ladkani@gmail.com
parent af21c717

lib/test_bpf.c

+63 −0
Original line number Diff line number Diff line
@@ -6859,6 +6859,60 @@ err_page0: 
	return NULL;

}



static __init struct sk_buff *build_test_skb_linear_no_head_frag(void)

{

	unsigned int alloc_size = 2000;

	unsigned int headroom = 102, doffset = 72, data_size = 1308;

	struct sk_buff *skb[2];

	int i;



	/* skbs linked in a frag_list, both with linear data, with head_frag=0

	 * (data allocated by kmalloc), both have tcp data of 1308 bytes

	 * (total payload is 2616 bytes).

	 * Data offset is 72 bytes (40 ipv6 hdr, 32 tcp hdr). Some headroom.

	 */

	for (i = 0; i < 2; i++) {

		skb[i] = alloc_skb(alloc_size, GFP_KERNEL);

		if (!skb[i]) {

			if (i == 0)

				goto err_skb0;

			else

				goto err_skb1;

		}



		skb[i]->protocol = htons(ETH_P_IPV6);

		skb_reserve(skb[i], headroom);

		skb_put(skb[i], doffset + data_size);

		skb_reset_network_header(skb[i]);

		if (i == 0)

			skb_reset_mac_header(skb[i]);

		else

			skb_set_mac_header(skb[i], -ETH_HLEN);

		__skb_pull(skb[i], doffset);

	}



	/* setup shinfo.

	 * mimic bpf_skb_proto_4_to_6, which resets gso_segs and assigns a

	 * reduced gso_size.

	 */

	skb_shinfo(skb[0])->gso_size = 1288;

	skb_shinfo(skb[0])->gso_type = SKB_GSO_TCPV6 | SKB_GSO_DODGY;

	skb_shinfo(skb[0])->gso_segs = 0;

	skb_shinfo(skb[0])->frag_list = skb[1];



	/* adjust skb[0]'s len */

	skb[0]->len += skb[1]->len;

	skb[0]->data_len += skb[1]->len;

	skb[0]->truesize += skb[1]->truesize;



	return skb[0];



err_skb1:

	kfree_skb(skb[0]);

err_skb0:

	return NULL;

}



struct skb_segment_test {

	const char *descr;

	struct sk_buff *(*build_skb)(void);
@@ -6871,6 +6925,15 @@ static struct skb_segment_test skb_segment_tests[] __initconst = { 
		.build_skb = build_test_skb,

		.features = NETIF_F_SG | NETIF_F_GSO_PARTIAL | NETIF_F_IP_CSUM |

			    NETIF_F_IPV6_CSUM | NETIF_F_RXCSUM

	},

	{

		.descr = "gso_linear_no_head_frag",

		.build_skb = build_test_skb_linear_no_head_frag,

		.features = NETIF_F_SG | NETIF_F_FRAGLIST |

			    NETIF_F_HW_VLAN_CTAG_TX | NETIF_F_GSO |

			    NETIF_F_LLTX_BIT | NETIF_F_GRO |

			    NETIF_F_IPV6_CSUM | NETIF_F_RXCSUM |

			    NETIF_F_HW_VLAN_STAG_TX_BIT

	}

};

CRA Git | Maintained and supported by SUSTech CRA and CCSE