ipv4: allow local fragmentation in ip_finish_output_gso()

[ Upstream commit 9ee6c5dc816aa8256257f2cd4008a9291ec7e985 ]

Some configurations (e.g. geneve interface with default
MTU of 1500 over an ethernet interface with 1500 MTU) result
in the transmission of packets that exceed the configured MTU.
While this should be considered to be a "bad" configuration,
it is still allowed and should not result in the sending
of packets that exceed the configured MTU.

Fix by dropping the assumption in ip_finish_output_gso() that
locally originated gso packets will never need fragmentation.
Basic testing using iperf (observing CPU usage and bandwidth)
have shown no measurable performance impact for traffic not
requiring fragmentation.

Fixes: c7ba65d7b649 ("net: ip: push gso skb forwarding handling down the stack")
Reported-by: Jan Tluka <jtluka@redhat.com>
Signed-off-by: Lance Richardson <lrichard@redhat.com>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/include/net/ip.h b/include/net/ip.h
index 156b0c11b52434841b1f157ba2ebcc0d85e95bff..0ccf6daf6f56452348d10601d613a0d58ad69ec0 100644 (file)
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -47,7 +47,6 @@ struct inet_skb_parm {
 #define IPSKB_REROUTED         BIT(4)
 #define IPSKB_DOREDIRECT       BIT(5)
 #define IPSKB_FRAG_PMTU                BIT(6)
-#define IPSKB_FRAG_SEGS                BIT(7)
 
        u16                     frag_max_size;
 };

diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
index 8b4ffd2168395b4d3b6ec67e166af13c122128ca..9f0a7b96646f368021d9cd51bc3f728ba49eed0d 100644 (file)
--- a/net/ipv4/ip_forward.c
+++ b/net/ipv4/ip_forward.c
@@ -117,7 +117,7 @@ int ip_forward(struct sk_buff *skb)
        if (opt->is_strictroute && rt->rt_uses_gateway)
                goto sr_failed;
 
-       IPCB(skb)->flags |= IPSKB_FORWARDED | IPSKB_FRAG_SEGS;
+       IPCB(skb)->flags |= IPSKB_FORWARDED;
        mtu = ip_dst_mtu_maybe_forward(&rt->dst, true);
        if (ip_exceeds_mtu(skb, mtu)) {
                IP_INC_STATS(net, IPSTATS_MIB_FRAGFAILS);

diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index dde37fb340bf90cdbba48489922f2c61b110066d..307daed9a4b9319e64a1c4e279c5c1bff70a5187 100644 (file)
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -223,11 +223,9 @@ static int ip_finish_output_gso(struct net *net, struct sock *sk,
        struct sk_buff *segs;
        int ret = 0;
 
-       /* common case: fragmentation of segments is not allowed,
-        * or seglen is <= mtu
+       /* common case: seglen is <= mtu
         */
-       if (((IPCB(skb)->flags & IPSKB_FRAG_SEGS) == 0) ||
-             skb_gso_validate_mtu(skb, mtu))
+       if (skb_gso_validate_mtu(skb, mtu))
                return ip_finish_output2(net, sk, skb);
 
        /* Slowpath -  GSO segment length is exceeding the dst MTU.

diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c
index 0f227db0e9ac6637c444fc8060b2e8f067653c3d..afd6b5968cafb720405c8243f9f0d9491a1bfd07 100644 (file)
--- a/net/ipv4/ip_tunnel_core.c
+++ b/net/ipv4/ip_tunnel_core.c
@@ -63,7 +63,6 @@ void iptunnel_xmit(struct sock *sk, struct rtable *rt, struct sk_buff *skb,
        int pkt_len = skb->len - skb_inner_network_offset(skb);
        struct net *net = dev_net(rt->dst.dev);
        struct net_device *dev = skb->dev;
-       int skb_iif = skb->skb_iif;
        struct iphdr *iph;
        int err;
 
@@ -73,16 +72,6 @@ void iptunnel_xmit(struct sock *sk, struct rtable *rt, struct sk_buff *skb,
        skb_dst_set(skb, &rt->dst);
        memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
 
-       if (skb_iif && !(df & htons(IP_DF))) {
-               /* Arrived from an ingress interface, got encapsulated, with
-                * fragmentation of encapulating frames allowed.
-                * If skb is gso, the resulting encapsulated network segments
-                * may exceed dst mtu.
-                * Allow IP Fragmentation of segments.
-                */
-               IPCB(skb)->flags |= IPSKB_FRAG_SEGS;
-       }
-
        /* Push down and install the IP header. */
        skb_push(skb, sizeof(struct iphdr));
        skb_reset_network_header(skb);

diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 5f006e13de567ad65ce856a47c118f5ea91ac671..27089f5ebbb1c1c6e13038a94aeee5209e03d532 100644 (file)
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -1749,7 +1749,7 @@ static void ipmr_queue_xmit(struct net *net, struct mr_table *mrt,
                vif->dev->stats.tx_bytes += skb->len;
        }
 
-       IPCB(skb)->flags |= IPSKB_FORWARDED | IPSKB_FRAG_SEGS;
+       IPCB(skb)->flags |= IPSKB_FORWARDED;
 
        /* RFC1584 teaches, that DVMRP/PIM router must deliver packets locally
         * not only before forwarding, but after forwarding on all output