[PATCH v5 net 0/2] net: udp: fix Fast/frag0 UDP GRO

[PATCH v5 net 0/2] net: udp: fix Fast/frag0 UDP GRO

[Alexander Lobakin]

While testing UDP GSO fraglists forwarding through driver that uses
Fast GRO (via napi_gro_frags()), I was observing lots of out-of-order
iperf packets:

[ ID] Interval           Transfer     Bitrate         Jitter
[SUM]  0.0-40.0 sec  12106 datagrams received out-of-order

Simple switch to napi_gro_receive() or any other method without frag0
shortcut completely resolved them.

I've found two incorrect header accesses in GRO receive callback(s):
 - udp_hdr() (instead of udp_gro_udphdr()) that always points to junk
   in "fast" mode and could probably do this in "regular".
   This was the actual bug that caused all out-of-order delivers;
 - udp{4,6}_lib_lookup_skb() -> ip{,v6}_hdr() (instead of
   skb_gro_network_header()) that potentionally might return odd
   pointers in both modes.

Each patch addresses one of these two issues.

This doesn't cover a support for nested tunnels as it's out of the
subject and requires more invasive changes. It will be handled
separately in net-next series.

Credits:
Cc: Eric Dumazet <edumazet@google.com>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Willem de Bruijn <willemb@google.com>

Since v4 [0]:
 - split the fix into two logical ones (Willem);
 - replace ternaries with plain ifs to beautify the code (Jakub);
 - drop p->data part to reintroduce it later in abovementioned set.

Since v3 [1]:
 - restore the original {,__}udp{4,6}_lib_lookup_skb() and use
   private versions of them inside GRO code (Willem).

Since v2 [2]:
 - dropped redundant check introduced in v2 as it's performed right
   before (thanks to Eric);
 - udp_hdr() switched to data + off for skbs from list (also Eric);
 - fixed possible malfunction of {,__}udp{4,6}_lib_lookup_skb() with
   Fast/frag0 due to ip{,v6}_hdr() usage (Willem).

Since v1 [3]:
 - added a NULL pointer check for "uh" as suggested by Willem.

[0] https://lore.kernel.org/netdev/Ha2hou5eJPcblo4abjAqxZRzIl1RaLs2Hy0oOAgFs@cp4-web-036.plabs.ch
[1] https://lore.kernel.org/netdev/MgZce9htmEtCtHg7pmWxXXfdhmQ6AHrnltXC41zOoo@cp7-web-042.plabs.ch
[2] https://lore.kernel.org/netdev/0eaG8xtbtKY1dEKCTKUBubGiC9QawGgB3tVZtNqVdY@cp4-web-030.plabs.ch
[3] https://lore.kernel.org/netdev/YazU6GEzBdpyZMDMwJirxDX7B4sualpDG68ADZYvJI@cp4-web-034.plabs.ch

Alexander Lobakin (2):
  net: udp: fix UDP header access on Fast/frag0 UDP GRO
  net: udp: fix IP header access and skb lookup on Fast/frag0 UDP GRO

 net/ipv4/udp_offload.c | 19 ++++++++++++++++---
 net/ipv6/udp_offload.c | 17 +++++++++++++++--
 2 files changed, 31 insertions(+), 5 deletions(-)

-- 
2.29.2

Re: [PATCH v5 net 0/2] net: udp: fix Fast/frag0 UDP GRO

[Jakub Kicinski]

On Wed, 11 Nov 2020 20:44:08 +0000 Alexander Lobakin wrote:
> While testing UDP GSO fraglists forwarding through driver that uses
> Fast GRO (via napi_gro_frags()), I was observing lots of out-of-order
> iperf packets:
> 
> [ ID] Interval           Transfer     Bitrate         Jitter
> [SUM]  0.0-40.0 sec  12106 datagrams received out-of-order
> 
> Simple switch to napi_gro_receive() or any other method without frag0
> shortcut completely resolved them.
> 
> I've found two incorrect header accesses in GRO receive callback(s):
>  - udp_hdr() (instead of udp_gro_udphdr()) that always points to junk
>    in "fast" mode and could probably do this in "regular".
>    This was the actual bug that caused all out-of-order delivers;
>  - udp{4,6}_lib_lookup_skb() -> ip{,v6}_hdr() (instead of
>    skb_gro_network_header()) that potentionally might return odd
>    pointers in both modes.
> 
> Each patch addresses one of these two issues.
> 
> This doesn't cover a support for nested tunnels as it's out of the
> subject and requires more invasive changes. It will be handled
> separately in net-next series.

Applied, thanks!