From af21c717f4757985771e2cee0b6e0cf21b831477 Mon Sep 17 00:00:00 2001 From: Shmulik Ladkani Date: Fri, 25 Oct 2019 16:42:22 +0300 Subject: bpf, testing: Refactor test_skb_segment() for testing skb_segment() on different skbs Currently, test_skb_segment() builds a single test skb and runs skb_segment() on it. Extend test_skb_segment() so it processes an array of numerous skb/feature pairs to test. Signed-off-by: Shmulik Ladkani Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20191025134223.2761-2-shmulik.ladkani@gmail.com --- lib/test_bpf.c | 51 +++++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 41 insertions(+), 10 deletions(-) (limited to 'lib') diff --git a/lib/test_bpf.c b/lib/test_bpf.c index 5ef3eccee27c..c952df82b515 100644 --- a/lib/test_bpf.c +++ b/lib/test_bpf.c @@ -6859,34 +6859,65 @@ err_page0: return NULL; } -static __init int test_skb_segment(void) -{ +struct skb_segment_test { + const char *descr; + struct sk_buff *(*build_skb)(void); netdev_features_t features; +}; + +static struct skb_segment_test skb_segment_tests[] __initconst = { + { + .descr = "gso_with_rx_frags", + .build_skb = build_test_skb, + .features = NETIF_F_SG | NETIF_F_GSO_PARTIAL | NETIF_F_IP_CSUM | + NETIF_F_IPV6_CSUM | NETIF_F_RXCSUM + } +}; + +static __init int test_skb_segment_single(const struct skb_segment_test *test) +{ struct sk_buff *skb, *segs; int ret = -1; - features = NETIF_F_SG | NETIF_F_GSO_PARTIAL | NETIF_F_IP_CSUM | - NETIF_F_IPV6_CSUM; - features |= NETIF_F_RXCSUM; - skb = build_test_skb(); + skb = test->build_skb(); if (!skb) { pr_info("%s: failed to build_test_skb", __func__); goto done; } - segs = skb_segment(skb, features); + segs = skb_segment(skb, test->features); if (!IS_ERR(segs)) { kfree_skb_list(segs); ret = 0; - pr_info("%s: success in skb_segment!", __func__); - } else { - pr_info("%s: failed in skb_segment!", __func__); } kfree_skb(skb); done: return ret; } +static __init int test_skb_segment(void) +{ + int i, err_cnt = 0, pass_cnt = 0; + + for (i = 0; i < ARRAY_SIZE(skb_segment_tests); i++) { + const struct skb_segment_test *test = &skb_segment_tests[i]; + + pr_info("#%d %s ", i, test->descr); + + if (test_skb_segment_single(test)) { + pr_cont("FAIL\n"); + err_cnt++; + } else { + pr_cont("PASS\n"); + pass_cnt++; + } + } + + pr_info("%s: Summary: %d PASSED, %d FAILED\n", __func__, + pass_cnt, err_cnt); + return err_cnt ? -EINVAL : 0; +} + static __init int test_bpf(void) { int i, err_cnt = 0, pass_cnt = 0; -- cgit v1.2.3-58-ga151 From cf204a718357c3c28557cc6bdc77a3adc33d0741 Mon Sep 17 00:00:00 2001 From: Shmulik Ladkani Date: Fri, 25 Oct 2019 16:42:23 +0300 Subject: bpf, testing: Introduce 'gso_linear_no_head_frag' skb_segment test Following reports of skb_segment() hitting a BUG_ON when working on GROed skbs which have their gso_size mangled (e.g. after a bpf_skb_change_proto call), add a reproducer test that mimics the input skbs that lead to the mentioned BUG_ON as in [1] and validates the fix submitted in [2]. [1] https://lists.openwall.net/netdev/2019/08/26/110 [2] commit 3dcbdb134f32 ("net: gso: Fix skb_segment splat when splitting gso_size mangled skb having linear-headed frag_list") Signed-off-by: Shmulik Ladkani Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20191025134223.2761-3-shmulik.ladkani@gmail.com --- lib/test_bpf.c | 63 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 63 insertions(+) (limited to 'lib') diff --git a/lib/test_bpf.c b/lib/test_bpf.c index c952df82b515..cecb230833be 100644 --- a/lib/test_bpf.c +++ b/lib/test_bpf.c @@ -6859,6 +6859,60 @@ err_page0: return NULL; } +static __init struct sk_buff *build_test_skb_linear_no_head_frag(void) +{ + unsigned int alloc_size = 2000; + unsigned int headroom = 102, doffset = 72, data_size = 1308; + struct sk_buff *skb[2]; + int i; + + /* skbs linked in a frag_list, both with linear data, with head_frag=0 + * (data allocated by kmalloc), both have tcp data of 1308 bytes + * (total payload is 2616 bytes). + * Data offset is 72 bytes (40 ipv6 hdr, 32 tcp hdr). Some headroom. + */ + for (i = 0; i < 2; i++) { + skb[i] = alloc_skb(alloc_size, GFP_KERNEL); + if (!skb[i]) { + if (i == 0) + goto err_skb0; + else + goto err_skb1; + } + + skb[i]->protocol = htons(ETH_P_IPV6); + skb_reserve(skb[i], headroom); + skb_put(skb[i], doffset + data_size); + skb_reset_network_header(skb[i]); + if (i == 0) + skb_reset_mac_header(skb[i]); + else + skb_set_mac_header(skb[i], -ETH_HLEN); + __skb_pull(skb[i], doffset); + } + + /* setup shinfo. + * mimic bpf_skb_proto_4_to_6, which resets gso_segs and assigns a + * reduced gso_size. + */ + skb_shinfo(skb[0])->gso_size = 1288; + skb_shinfo(skb[0])->gso_type = SKB_GSO_TCPV6 | SKB_GSO_DODGY; + skb_shinfo(skb[0])->gso_segs = 0; + skb_shinfo(skb[0])->frag_list = skb[1]; + + /* adjust skb[0]'s len */ + skb[0]->len += skb[1]->len; + skb[0]->data_len += skb[1]->len; + skb[0]->truesize += skb[1]->truesize; + + return skb[0]; + +err_skb1: + kfree_skb(skb[0]); +err_skb0: + return NULL; +} + struct skb_segment_test { const char *descr; struct sk_buff *(*build_skb)(void); @@ -6871,6 +6925,15 @@ static struct skb_segment_test skb_segment_tests[] __initconst = { .build_skb = build_test_skb, .features = NETIF_F_SG | NETIF_F_GSO_PARTIAL | NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM | NETIF_F_RXCSUM + }, + { + .descr = "gso_linear_no_head_frag", + .build_skb = build_test_skb_linear_no_head_frag, + .features = NETIF_F_SG | NETIF_F_FRAGLIST | + NETIF_F_HW_VLAN_CTAG_TX | NETIF_F_GSO | + NETIF_F_LLTX_BIT | NETIF_F_GRO | + NETIF_F_IPV6_CSUM | NETIF_F_RXCSUM | + NETIF_F_HW_VLAN_STAG_TX_BIT } }; -- cgit v1.2.3-58-ga151