Daniel Borkmann f8ffad69c9 bpf: add skb_postpush_rcsum and fix dev_forward_skb occasions ... Add a small helper skb_postpush_rcsum() and fix up redirect locations that need CHECKSUM_COMPLETE fixups on ingress. dev_forward_skb() expects a proper csum that covers also Ethernet header, f.e. since 2c26d34bbc ("net/core: Handle csum for CHECKSUM_COMPLETE VXLAN forwarding"), we also do skb_postpull_rcsum() after pulling Ethernet header off via eth_type_trans(). When using eBPF in a netns setup f.e. with vxlan in collect metadata mode, I can trigger the following csum issue with an IPv6 setup: [ 505.144065] dummy1: hw csum failure [...] [ 505.144108] Call Trace: [ 505.144112] <IRQ> [<ffffffff81372f08>] dump_stack+0x44/0x5c [ 505.144134] [<ffffffff81607cea>] netdev_rx_csum_fault+0x3a/0x40 [ 505.144142] [<ffffffff815fee3f>] __skb_checksum_complete+0xcf/0xe0 [ 505.144149] [<ffffffff816f0902>] nf_ip6_checksum+0xb2/0x120 [ 505.144161] [<ffffffffa08c0e0e>] icmpv6_error+0x17e/0x328 [nf_conntrack_ipv6] [ 505.144170] [<ffffffffa0898eca>] ? ip6t_do_table+0x2fa/0x645 [ip6_tables] [ 505.144177] [<ffffffffa08c0725>] ? ipv6_get_l4proto+0x65/0xd0 [nf_conntrack_ipv6] [ 505.144189] [<ffffffffa06c9a12>] nf_conntrack_in+0xc2/0x5a0 [nf_conntrack] [ 505.144196] [<ffffffffa08c039c>] ipv6_conntrack_in+0x1c/0x20 [nf_conntrack_ipv6] [ 505.144204] [<ffffffff8164385d>] nf_iterate+0x5d/0x70 [ 505.144210] [<ffffffff816438d6>] nf_hook_slow+0x66/0xc0 [ 505.144218] [<ffffffff816bd302>] ipv6_rcv+0x3f2/0x4f0 [ 505.144225] [<ffffffff816bca40>] ? ip6_make_skb+0x1b0/0x1b0 [ 505.144232] [<ffffffff8160b77b>] __netif_receive_skb_core+0x36b/0x9a0 [ 505.144239] [<ffffffff8160bdc8>] ? __netif_receive_skb+0x18/0x60 [ 505.144245] [<ffffffff8160bdc8>] __netif_receive_skb+0x18/0x60 [ 505.144252] [<ffffffff8160ccff>] process_backlog+0x9f/0x140 [ 505.144259] [<ffffffff8160c4a5>] net_rx_action+0x145/0x320 [...] What happens is that on ingress, we push Ethernet header back in, either from cls_bpf or right before skb_do_redirect(), but without updating csum. The "hw csum failure" can be fixed by using the new skb_postpush_rcsum() helper for the dev_forward_skb() case to correct the csum diff again. Thanks to Hannes Frederic Sowa for the csum_partial() idea! Fixes: 3896d655f4 ("bpf: introduce bpf_clone_redirect() helper") Fixes: 27b29f6305 ("bpf: add bpf_redirect() helper") Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>		2016-01-10 17:54:28 -05:00
..
datagram.c	net: Fix inverted test in __skb_recv_datagram	2015-12-08 11:30:17 -05:00
dev.c	net: Add driver helper functions to determine checksum offloadability	2015-12-15 16:50:21 -05:00
dev_addr_lists.c	net: fix spelling for synchronized	2014-11-18 15:26:32 -05:00
dev_ioctl.c	dev_ioctl: use sizeof(x) instead of sizeof x	2014-11-18 15:27:32 -05:00
drop_monitor.c	net: Replace get_cpu_var through this_cpu_ptr	2014-08-26 13:45:47 -04:00
dst.c	net: possible use after free in dst_release	2016-01-06 15:00:27 -05:00
ethtool.c	ethtool: Add phy statistics	2015-12-31 00:53:10 -05:00
fib_rules.c	fib_rules: fix fib rule dumps across multiple skbs	2015-09-24 15:21:54 -07:00
filter.c	bpf: add skb_postpush_rcsum and fix dev_forward_skb occasions	2016-01-10 17:54:28 -05:00
flow.c	flow: Move __get_hash_from_flowi{4,6} into flow_dissector.c	2015-09-01 17:00:24 -07:00
flow_dissector.c	flow_dissector: Use 'const' where possible.	2015-09-01 21:19:17 -07:00
gen_estimator.c	net_sched: gen_estimator: extend pps limit	2015-07-08 13:59:20 -07:00
gen_stats.c	gen_stats.c: Duplicate xstats buffer for later use	2015-02-19 15:45:53 -05:00
link_watch.c	dev: introduce dev_get_iflink()	2015-04-02 14:04:59 -04:00
lwtunnel.c	dst: Pass net into dst->output	2015-10-08 04:27:03 -07:00
Makefile	soreuseport: define reuseport groups	2016-01-04 22:49:58 -05:00
neighbour.c	net/neighbour: fix crash at dumping device-agnostic proxy entries	2015-12-03 00:07:51 -05:00
net-procfs.c
net-sysfs.c	net-sysfs: use to_net_dev in net_namespace()	2015-12-22 15:04:09 -05:00
net-sysfs.h	net: netdev_kobject_init: annotate with __init	2014-01-05 20:27:54 -05:00
net-traces.c	net: IPv6 fib lookup tracepoint	2015-11-22 11:54:10 -05:00
net_namespace.c	netns: make nsid_lock per net	2015-05-17 23:41:11 -04:00
netclassid_cgroup.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2015-12-17 22:08:28 -05:00
netevent.c	netevent: remove automatic variable in register_netevent_notifier()	2015-05-31 00:03:21 -07:00
netpoll.c	netpoll: Drop budget parameter from NAPI polling call hierarchy	2015-09-29 14:57:16 -07:00
netprio_cgroup.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2015-12-17 22:08:28 -05:00
pktgen.c	net: Eliminate NETIF_F_GEN_CSUM and NETIF_F_V[46]_CSUM	2015-12-15 16:50:20 -05:00
ptp_classifier.c	ptp: Change ptp_class to a proper bitmask	2015-11-03 11:08:22 -05:00
request_sock.c	tcp: restore fastopen operations	2015-10-05 03:19:06 -07:00
rtnetlink.c	net: Pass ndm_state to route netlink FDB notifications.	2015-12-16 18:36:46 -05:00
scm.c	net: wrap sock->sk_cgrp_prioidx and ->sk_classid inside a struct	2015-12-08 22:02:33 -05:00
secure_seq.c	net: remove a sparse error in secure_dccpv6_sequence_number()	2015-05-25 22:55:37 -04:00
skbuff.c	net: check both type and procotol for tcp sockets	2015-12-17 15:46:32 -05:00
sock.c	soreuseport: setsockopt SO_ATTACH_REUSEPORT_[CE]BPF	2016-01-04 22:49:59 -05:00
sock_diag.c	net: diag: Add the ability to destroy a socket.	2015-12-15 23:26:51 -05:00
sock_reuseport.c	soreuseport: change consume_skb to kfree_skb in error case	2016-01-06 01:30:27 -05:00
stream.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2015-12-03 21:09:12 -05:00
sysctl_net_core.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2015-03-20 18:51:09 -04:00
timestamping.c	net: skb_defer_rx_timestamp should check for phydev before setting up classify	2015-07-09 14:17:15 -07:00
tso.c	net: tso: add support for IPv6	2015-10-26 22:24:22 -07:00
utils.c	net: move net_get_random_once to lib	2015-10-08 05:26:35 -07:00