Eric Lee / smarc-ti-linux-kernel

5
Download as
Browse Code ยป

Commit 39c36094d78c39e038c1e499b2364e13bce36f54

Authored by Eric Dumazet
Committed by David S. Miller
1 parent fc0d6e9cd0
Exists in ti-lsk-linux-4.1.y and in 12 other branches dlt-processor-sdk-linux-03.00.00.04, processor-sdk-linux-02.00.01, smarc-ti-linux-3.15.y, smarc-ti-lsk-linux-4.1.y, smarct3x-processor-sdk-04.01.00.06, smarct3x-processor-sdk-linux-02.00.01, smarct3x-processor-sdk-linux-03.00.00.04, smarct4x-800-processor-sdk-linux-02.00.01, smarct4x-processor-sdk-04.01.00.06, smarct4x-processor-sdk-linux-02.00.01, smarct4x-processor-sdk-linux-03.00.00.04, ti-linux-3.15.y

net: fix inet_getid() and ipv6_select_ident() bugs 

I noticed we were sending wrong IPv4 ID in TCP flows when MTU discovery
is disabled.
Note how GSO/TSO packets do not have monotonically incrementing ID.

06:37:41.575531 IP (id 14227, proto: TCP (6), length: 4396)
06:37:41.575534 IP (id 14272, proto: TCP (6), length: 65212)
06:37:41.575544 IP (id 14312, proto: TCP (6), length: 57972)
06:37:41.575678 IP (id 14317, proto: TCP (6), length: 7292)
06:37:41.575683 IP (id 14361, proto: TCP (6), length: 63764)

It appears I introduced this bug in linux-3.1.

inet_getid() must return the old value of peer->ip_id_count,
not the new one.

Lets revert this part, and remove the prevention of
a null identification field in IPv6 Fragment Extension Header,
which is dubious and not even done properly.

Fixes: 87c48fa3b463 ("ipv6: make fragment identifications less predictable")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Showing 2 changed files with 4 additions and 16 deletions Side-by-side Diff

include/net/inetpeer.h
Diff comments   View file @ 39c3609
... ... @@ -177,16 +177,9 @@
177 177 /* can be called with or without local BH being disabled */
178 178 static inline int inet_getid(struct inet_peer *p, int more)
179 179 {
180   - int old, new;
181 180 more++;
182 181 inet_peer_refcheck(p);
183   - do {
184   - old = atomic_read(&p->ip_id_count);
185   - new = old + more;
186   - if (!new)
187   - new = 1;
188   - } while (atomic_cmpxchg(&p->ip_id_count, old, new) != old);
189   - return new;
  182 + return atomic_add_return(more, &p->ip_id_count) - more;
190 183 }
191 184  
192 185 #endif /* _NET_INETPEER_H */
net/ipv6/output_core.c
Diff comments   View file @ 39c3609
... ... @@ -12,7 +12,7 @@
12 12 {
13 13 static atomic_t ipv6_fragmentation_id;
14 14 struct in6_addr addr;
15   - int old, new;
  15 + int ident;
16 16  
17 17 #if IS_ENABLED(CONFIG_IPV6)
18 18 struct inet_peer *peer;
19 19  
... ... @@ -26,15 +26,10 @@
26 26 return;
27 27 }
28 28 #endif
29   - do {
30   - old = atomic_read(&ipv6_fragmentation_id);
31   - new = old + 1;
32   - if (!new)
33   - new = 1;
34   - } while (atomic_cmpxchg(&ipv6_fragmentation_id, old, new) != old);
  29 + ident = atomic_inc_return(&ipv6_fragmentation_id);
35 30  
36 31 addr = rt->rt6i_dst.addr;
37   - addr.s6_addr32[0] ^= (__force __be32)new;
  32 + addr.s6_addr32[0] ^= (__force __be32)ident;
38 33 fhdr->identification = htonl(secure_ipv6_id(addr.s6_addr32));
39 34 }
40 35 EXPORT_SYMBOL(ipv6_select_ident);