| Message ID | 20241004170328.10819-2-sherry.yang@oracle.com (mailing list archive) |
|---|---|
| State | Not Applicable |
| Headers | show |
| Series | Backport fix for CVE-2024-38538 | expand |
| Context | Check | Description |
|---|---|---|
| netdev/tree_selection | success | Guessing tree name failed - patch did not apply, async |
On Fri, Oct 04, 2024 at 10:03:27AM -0700, Sherry Yang wrote: > From: Eric Dumazet <edumazet@google.com> > > [ Upstream commit 1fb2d41501f38192d8a19da585cd441cf8845697 ] > > pskb_may_pull() can fail for two different reasons. > > Provide pskb_may_pull_reason() helper to distinguish > between these reasons. > > It returns: > > SKB_NOT_DROPPED_YET : Success > SKB_DROP_REASON_PKT_TOO_SMALL : packet too small > SKB_DROP_REASON_NOMEM : skb->head could not be resized > > Signed-off-by: Eric Dumazet <edumazet@google.com> > Reviewed-by: David Ahern <dsahern@kernel.org> > Signed-off-by: Jakub Kicinski <kuba@kernel.org> > Stable-dep-of: 8bd67ebb50c0 ("net: bridge: xmit: make sure we have at least eth header len bytes") > Signed-off-by: Sasha Levin <sashal@kernel.org> > [Sherry: bp to 5.15.y. Minor conflicts due to missing commit > d427c8999b07 ("net-next: skbuff: refactor pskb_pull") which is not > necessary in 5.15.y. Ignore context change. > Signed-off-by: Sherry Yang <sherry.yang@oracle.com> > --- > include/linux/skbuff.h | 19 +++++++++++++++---- > 1 file changed, 15 insertions(+), 4 deletions(-) > > diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h > index b230c422dc3b..f92e8fe4f5eb 100644 > --- a/include/linux/skbuff.h > +++ b/include/linux/skbuff.h > @@ -2465,13 +2465,24 @@ static inline void *pskb_pull(struct sk_buff *skb, unsigned int len) > return unlikely(len > skb->len) ? NULL : __pskb_pull(skb, len); > } > > -static inline bool pskb_may_pull(struct sk_buff *skb, unsigned int len) > +static inline enum skb_drop_reason > +pskb_may_pull_reason(struct sk_buff *skb, unsigned int len) > { > if (likely(len <= skb_headlen(skb))) > - return true; > + return SKB_NOT_DROPPED_YET; > + > if (unlikely(len > skb->len)) > - return false; > - return __pskb_pull_tail(skb, len - skb_headlen(skb)) != NULL; > + return SKB_DROP_REASON_PKT_TOO_SMALL; > + > + if (unlikely(!__pskb_pull_tail(skb, len - skb_headlen(skb)))) > + return SKB_DROP_REASON_NOMEM; > + > + return SKB_NOT_DROPPED_YET; > +} > + > +static inline bool pskb_may_pull(struct sk_buff *skb, unsigned int len) > +{ > + return pskb_may_pull_reason(skb, len) == SKB_NOT_DROPPED_YET; > } > > void skb_condense(struct sk_buff *skb); > -- > 2.46.0 > > Any specific reason why you didn't test build this patch? It breaks the build into thousands of tiny pieces. greg k-h
Hi Greg, > On Oct 8, 2024, at 3:36 AM, Greg KH <gregkh@linuxfoundation.org> wrote: > > On Fri, Oct 04, 2024 at 10:03:27AM -0700, Sherry Yang wrote: >> From: Eric Dumazet <edumazet@google.com> >> >> [ Upstream commit 1fb2d41501f38192d8a19da585cd441cf8845697 ] >> >> pskb_may_pull() can fail for two different reasons. >> >> Provide pskb_may_pull_reason() helper to distinguish >> between these reasons. >> >> It returns: >> >> SKB_NOT_DROPPED_YET : Success >> SKB_DROP_REASON_PKT_TOO_SMALL : packet too small >> SKB_DROP_REASON_NOMEM : skb->head could not be resized >> >> Signed-off-by: Eric Dumazet <edumazet@google.com> >> Reviewed-by: David Ahern <dsahern@kernel.org> >> Signed-off-by: Jakub Kicinski <kuba@kernel.org> >> Stable-dep-of: 8bd67ebb50c0 ("net: bridge: xmit: make sure we have at least eth header len bytes") >> Signed-off-by: Sasha Levin <sashal@kernel.org> >> [Sherry: bp to 5.15.y. Minor conflicts due to missing commit >> d427c8999b07 ("net-next: skbuff: refactor pskb_pull") which is not >> necessary in 5.15.y. Ignore context change. >> Signed-off-by: Sherry Yang <sherry.yang@oracle.com> >> --- >> include/linux/skbuff.h | 19 +++++++++++++++---- >> 1 file changed, 15 insertions(+), 4 deletions(-) >> >> diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h >> index b230c422dc3b..f92e8fe4f5eb 100644 >> --- a/include/linux/skbuff.h >> +++ b/include/linux/skbuff.h >> @@ -2465,13 +2465,24 @@ static inline void *pskb_pull(struct sk_buff *skb, unsigned int len) >> return unlikely(len > skb->len) ? NULL : __pskb_pull(skb, len); >> } >> >> -static inline bool pskb_may_pull(struct sk_buff *skb, unsigned int len) >> +static inline enum skb_drop_reason >> +pskb_may_pull_reason(struct sk_buff *skb, unsigned int len) >> { >> if (likely(len <= skb_headlen(skb))) >> - return true; >> + return SKB_NOT_DROPPED_YET; >> + >> if (unlikely(len > skb->len)) >> - return false; >> - return __pskb_pull_tail(skb, len - skb_headlen(skb)) != NULL; >> + return SKB_DROP_REASON_PKT_TOO_SMALL; >> + >> + if (unlikely(!__pskb_pull_tail(skb, len - skb_headlen(skb)))) >> + return SKB_DROP_REASON_NOMEM; >> + >> + return SKB_NOT_DROPPED_YET; >> +} >> + >> +static inline bool pskb_may_pull(struct sk_buff *skb, unsigned int len) >> +{ >> + return pskb_may_pull_reason(skb, len) == SKB_NOT_DROPPED_YET; >> } >> >> void skb_condense(struct sk_buff *skb); >> -- >> 2.46.0 >> >> > > Any specific reason why you didn't test build this patch? > > It breaks the build into thousands of tiny pieces. Sorry about the build failure. We have a branch which was forked from 5.15.y, and I did build and some smoke tests there. The build and smoke tests passed on our branch. However, I didn’t notice our branch backported prerequisite commits which made it diverge from linux-stable 5.15.y. I will apply the patch to upstream/linux-stable and build there before I send patch to upstream/linux-stable next time. Sorry about the inconvenience. Sherry > > greg k-h
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index b230c422dc3b..f92e8fe4f5eb 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -2465,13 +2465,24 @@ static inline void *pskb_pull(struct sk_buff *skb, unsigned int len) return unlikely(len > skb->len) ? NULL : __pskb_pull(skb, len); } -static inline bool pskb_may_pull(struct sk_buff *skb, unsigned int len) +static inline enum skb_drop_reason +pskb_may_pull_reason(struct sk_buff *skb, unsigned int len) { if (likely(len <= skb_headlen(skb))) - return true; + return SKB_NOT_DROPPED_YET; + if (unlikely(len > skb->len)) - return false; - return __pskb_pull_tail(skb, len - skb_headlen(skb)) != NULL; + return SKB_DROP_REASON_PKT_TOO_SMALL; + + if (unlikely(!__pskb_pull_tail(skb, len - skb_headlen(skb)))) + return SKB_DROP_REASON_NOMEM; + + return SKB_NOT_DROPPED_YET; +} + +static inline bool pskb_may_pull(struct sk_buff *skb, unsigned int len) +{ + return pskb_may_pull_reason(skb, len) == SKB_NOT_DROPPED_YET; } void skb_condense(struct sk_buff *skb);