On Thu, Jul 25, 2024 at 5:22 AM Denis Arefev arefev@swemel.ru wrote:
I checked the patch on three reproducers and all three DEFINITELY broke the core.
There are two malfunctions.
- No flag skb_shinfo(skb)->tx_flags |= SKBFL_SHARED_FRAG;
If it is not set then __skb_linearize will not be executed in skb_checksum_help. sk_buff remains fragmented (non-linear) and this is the first warning. OR add skb_shinfo(skb)->tx_flags |= SKBFL_SHARED_FRAG. OR ask Eric Dumazet (cef401de7be8c). Is checking if (skb_has_shared_frag(skb)) so important? in the skb_checksum_help function, is it enough if (skb_is_nonlinear(skb)) ?
Thanks for sharing the reproducers. Having a look.
On SKBFL_SHARED_FRAG: as Eric's commit indicates, that flag identifies packets with contents writable from userspace, such as vmsplice or later introduced MSG_ZEROCOPY. That is not the case for these packets.
Setting the flag may have the desired effect of triggering linearization, but it does not match the intent of the flag.
I think we can catch these bad packets with illegal csum_start and simply drop them. The question is where is the best place to detect them. I gave one suggestion. Great to have reproducers. Let's see if that indeed addresses them.