From: Ben Wei <benwei@fb.com>
To: David Miller <davem@davemloft.net>
Cc: "sam@mendozajonas.com" <sam@mendozajonas.com>,
"netdev@vger.kernel.org" <netdev@vger.kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
"openbmc@lists.ozlabs.org" <openbmc@lists.ozlabs.org>
Subject: RE: [PATCH net-next] net/ncsi: support unaligned payload size in NC-SI cmd handler
Date: Mon, 2 Sep 2019 23:43:42 +0000 [thread overview]
Message-ID: <CH2PR15MB36869BE1AA44813CE293891BA3BE0@CH2PR15MB3686.namprd15.prod.outlook.com> (raw)
In-Reply-To: <20190902.120300.174900457187536042.davem@davemloft.net>
> > Update NC-SI command handler (both standard and OEM) to take into
> > account of payload paddings in allocating skb (in case of payload
> > size is not 32-bit aligned).
> >
> > The checksum field follows payload field, without taking payload
> > padding into account can cause checksum being truncated, leading to
> > dropped packets.
> >
> > Signed-off-by: Ben Wei <benwei@fb.com>
>
> If you have to align and add padding, I do not see where you are
> clearing out that padding memory to make sure it is initialized.
>
> You do comparisons with 'payload' but make adjustments to 'len'.
>
> The logic is very confusing.
Yes let me clarify a bit.
In the code 'payload' is the exact NC-SI payload length, which goes into NC-SI packet header
and needs to be actual unpadded payload length.
'len' is used to allocate total NC-SI packet buffer (include padding).
The original calculation of 'len' was done by summing up NCSI header + payload + checksum,
without taking into account of possible padding, e.g.
len += sizeof(struct ncsi_cmd_pkt_hdr) + 4; /* 4 is the checksum size */
if (nca->payload < 26)
len += 26;
else
len += nca->payload;
/* Allocate skb */
skb = alloc_skb(len, GFP_ATOMIC);
This works today for all standard NC-SI commands (in spec v1.1) because all standard commands
have payload size < 26, and packet size is then set to minimum of 46 (16 hdr + 26 payload + 4 cksum) bytes.
And mem clearing is done in each of the standard cmd handlers, e.g.
ncsi_cmd_handler_sp, ncsi_cmd_handler_ae.
The problem occurs if payload >= 26 and is unaligned. This could happen on some OEM commands,
and I see this happening when we carry PLDM traffic over NC-SI packet.
(PLDM header being 3 bytes and payload size can be large)
The skb allocated would be too small, and later when checksum is calculated and written:
pchecksum = (__be32 *)((void *)h + sizeof(struct ncsi_pkt_hdr) +
ALIGN(nca->payload, 4));
*pchecksum = htonl(checksum);
Part of the checksum would fall outside of our allocated buffer.
PLDM over NC-SI and OEM NC-SI commands are currently handled in
@@ -213,17 +213,22 @@ static int ncsi_cmd_handler_oem(struct sk_buff *skb,
So here I ensure the skb allocation takes padding into account, and do the initial mem clearing
to set the padding bytes
+ unsigned short payload = ALIGN(nca->payload, 4);
len = sizeof(struct ncsi_cmd_pkt_hdr) + 4;
- if (nca->payload < 26)
+ if (payload < 26)
len += 26;
else
- len += nca->payload;
+ len += payload;
cmd = skb_put_zero(skb, len);
memcpy(&cmd->mfr_id, nca->data, nca->payload);
So in this patch I updated both standard command handler (in case future spec updates adds
commands with payload >= 26) and OEM/generic command handler to support unaligned payload
size.
Regards,
-Ben
next prev parent reply other threads:[~2019-09-02 23:44 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-09-02 2:46 [PATCH net-next] net/ncsi: support unaligned payload size in NC-SI cmd handler Ben Wei
2019-09-02 19:03 ` David Miller
2019-09-02 23:43 ` Ben Wei [this message]
2019-09-03 19:21 ` Justin.Lee1
2019-09-12 19:45 ` Ben Wei
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CH2PR15MB36869BE1AA44813CE293891BA3BE0@CH2PR15MB3686.namprd15.prod.outlook.com \
--to=benwei@fb.com \
--cc=davem@davemloft.net \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=openbmc@lists.ozlabs.org \
--cc=sam@mendozajonas.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).