CVE-2017-1000112-UFO 学习总结

Make 
Make bzImage
Make modules
Make modules_install
Make install

static int __ip_append_data(struct sock *sk,
                struct flowi4 *fl4,
                struct sk_buff_head *queue,
                struct inet_cork *cork,
                struct page_frag *pfrag,
                int getfrag(void *from, char *to, int offset,
                    int len, int odd, struct sk_buff *skb),
                void *from, int length, int transhdrlen,
                unsigned int flags)
{
    struct inet_sock *inet = inet_sk(sk);
    struct sk_buff *skb;

    struct ip_options *opt = cork->opt;
    int hh_len;
    int exthdrlen;
    int mtu;
    int copy;
    int err;
    int offset = 0;
    unsigned int maxfraglen, fragheaderlen, maxnonfragsize;
    int csummode = CHECKSUM_NONE;
    struct rtable *rt = (struct rtable *)cork->dst;
    u32 tskey = 0;

    skb = skb_peek_tail(queue);

    exthdrlen = !skb ? rt->dst.header_len : 0;
    mtu = cork->fragsize;
    if (cork->tx_flags & SKBTX_ANY_SW_TSTAMP &&
        sk->sk_tsflags & SOF_TIMESTAMPING_OPT_ID)
        tskey = sk->sk_tskey++;

    hh_len = LL_RESERVED_SPACE(rt->dst.dev); //获取链路层首部及IP首部（包括选项）的长度 hh_len=16

    fragheaderlen = sizeof(struct iphdr) + (opt ? opt->optlen : 0);
    maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen; //1500,mtu=1500,fragheaderlen=20
    //IP数据报的数据需要4字节对齐，为加速计算直接将IP数据报的数据根据当前MTU8字节对齐，然后重新得到用于分片的长度
    maxnonfragsize = ip_sk_ignore_df(sk) ? 0xFFFF : mtu;

    if (cork->length + length > maxnonfragsize - fragheaderlen) {
        ip_local_error(sk, EMSGSIZE, fl4->daddr, inet->inet_dport,
                   mtu - (opt ? opt->optlen : 0));
        return -EMSGSIZE;
    }//如果输出的数据长度超过一个IP数据报能容纳的长度，则向输出该数据报的套接口发送EMSGSIZE

    /*
     * transhdrlen > 0 means that this is the first fragment and we wish
     * it won't be fragmented in the future.
     */
    if (transhdrlen &&//如果IP数据报没有分片，且输出网络设备支持硬件执行校验和，则设置CHECKSUM_PARTIAL，表示由硬件来执行校验和 transhdrlen = 8, length = 3492
        length + fragheaderlen <= mtu &&
        rt->dst.dev->features & NETIF_F_V4_CSUM &&
        !(flags & MSG_MORE) &&
        !exthdrlen)
        csummode = CHECKSUM_PARTIAL;

cork->length += length;//如果输出的是UDP数据报且需要分片，同时输出网络设备支持UDP分片卸载（UDP fragmentation offload），则由ip_ufo_append_data（）进行分片输出处理。
if ((((length + (skb ? skb->len : fragheaderlen)) > mtu) ||
-	     (skb && skb_is_gso(skb))) &&
(sk->sk_protocol == IPPROTO_UDP) &&
 	    (rt->dst.dev->features & NETIF_F_UFO) && !dst_xfrm(&rt->dst) &&
-	    (sk->sk_type == SOCK_DGRAM) && !sk->sk_no_check_tx) {
        err = ip_ufo_append_data(sk, queue, getfrag, from, length,
                     hh_len, fragheaderlen, transhdrlen,
                     maxfraglen, flags);
        if (err)
            goto error;
        return 0;
    }

    /* So, what's going on in the loop below?
     *
     * We use calculated fragment length to generate chained skb,
     * each of segments is IP fragment ready for sending to network after
     * adding appropriate IP header.
     */

    if (!skb)
        goto alloc_new_skb;//获取输出队列末尾的SKB，如果获取不到，说明输出队列为空，则需分配一个新的SKB用于复制数据

    while (length > 0) {//循环处理待输出数据，直至所有的数据都处理完成
        /* Check if the remaining data fits into current packet. */
        copy = mtu - skb->len; //得到上一个SKB的剩余空间大小，也就是本次复制数据的长度 mtu=1500,skb->3512
        if (copy < length)//length为数据的长度，空间小于数据大小，就要 length=1
            copy = maxfraglen - skb->len;  //maxfraglen=1500, copy=-2012
        if (copy <= 0) { //当本次复制数据的长度copy小于或等于0时，说明上一个SKB已经填满或空间不足8B，需要分配新的SKB
            char *data;
            unsigned int datalen;
            unsigned int fraglen;
            unsigned int fraggap;
            unsigned int alloclen;
            struct sk_buff *skb_prev;
alloc_new_skb:
            skb_prev = skb;//如果上一个SKB中存在多余8字节对齐的MTU数据，要计算移动到当前SKB的数据长度
            if (skb_prev)
                fraggap = skb_prev->len - maxfraglen;// fraggap=3512-1500=2012
            else
                fraggap = 0;

            /*
             * If remaining data exceeds the mtu,
             * we know we need more fragment(s).
             */
            datalen = length + fraggap; //datalen=1+2012=2013
            if (datalen > mtu - fragheaderlen)  //如果剩余的数据一个分片不够容纳，则根据MTU重新计算本次可发送的数据长度
                datalen = maxfraglen - fragheaderlen; //datalen=1500-20=1480
            fraglen = datalen + fragheaderlen; //根据本次复制的数据长度以及IP首部长度，计算三层首部及数据的总长度

            if ((flags & MSG_MORE) &&
                !(rt->dst.dev->features&NETIF_F_SG))
                alloclen = mtu;  //如果后续还有数据输出且网络设备不支持聚合分散I/O,则将MTU作为分配SKB的长度
            else
                alloclen = fraglen;//否则按数据的长度（包括IP首部）分配SKB的空间即可

            alloclen += exthdrlen; //alloclen=1500+0=1500

            /* The last fragment gets additional space at tail.
             * Note, with MSG_MORE we overallocate on fragments,
             * because we have no idea what fragment will be
             * the last.
             */
            if (datalen == length + fraggap)
                alloclen += rt->dst.trailer_len;

            if (transhdrlen) { //根据是否存在传输层首部，确定用何种方法分配SKB
                skb = sock_alloc_send_skb(sk,
                        alloclen + hh_len + 15,
                        (flags & MSG_DONTWAIT), &err);
            } else {
                skb = NULL;
                if (atomic_read(&sk->sk_wmem_alloc) <=
                    2 * sk->sk_sndbuf)
                    skb = sock_wmalloc(sk,
                               alloclen + hh_len + 15, 1,
                               sk->sk_allocation);
                if (unlikely(!skb))
                    err = -ENOBUFS;
            }
            if (!skb)
                goto error;

            /*
             *  Fill in the control structures
             */
            skb->ip_summed = csummode; //填充用于校验的控制信息
            skb->csum = 0;
            skb_reserve(skb, hh_len);//为数据报预留用于存放二层首部、三层首部和数据的空间，并设置SKB中指向三层和四层的指针

            /* only the initial fragment is time stamped */
            skb_shinfo(skb)->tx_flags = cork->tx_flags;
            cork->tx_flags = 0;
            skb_shinfo(skb)->tskey = tskey;
            tskey = 0;

            /*
             *  Find where to start putting bytes.
             */
            data = skb_put(skb, fraglen + exthdrlen);
            skb_set_network_header(skb, exthdrlen);
            skb->transport_header = (skb->network_header +
                         fragheaderlen);
            data += fragheaderlen + exthdrlen;//data=20+0=20

            if (fraggap) { //如果上一个SKB的数据超过8字节对齐MTU，则将超出数据和传输层首部复制到当前SKB，重新计算校验和 fraggap=2012
                skb->csum = skb_copy_and_csum_bits( //并以8字节对齐MTU为长度截取上一个SKB的数据
                    skb_prev, maxfraglen,
                    data + transhdrlen, fraggap, 0);
                skb_prev->csum = csum_sub(skb_prev->csum,
                              skb->csum);
                data += fraggap; 
                pskb_trim_unique(skb_prev, maxfraglen);
            }

            copy = datalen - transhdrlen - fraggap;//传输层首部和上个SKB多出的数据已复制，接着复制剩下的数据 //copy = 1480-0-2012=-532
            if (copy > 0 && getfrag(from, data + transhdrlen, offset, copy, fraggap, skb) < 0) {
                err = -EFAULT;
                kfree_skb(skb);
                goto error;
            }

            offset += copy; //完成本次复制数据，计算下次需复制数据的地址及剩余数据的长度。传输层首部已经复制
            length -= datalen - fraggap;//因此需要将传输层首部的transhdrlen置为0，同时IPsec首部长度exthdrlen也置为0 //length=2013-1480=533
            transhdrlen = 0;
            exthdrlen = 0;
            csummode = CHECKSUM_NONE;

            /*
             * Put the packet on the pending queue.
             */
            __skb_queue_tail(queue, skb);//将复制完数据的SKB添加到输出队列的尾部，接着复制剩下的数据
            continue;
        }  

        if (copy > length)
            copy = length; //如果上个SKB剩余的空间大于剩余待发送的数据长度，则剩下的数据可以一次完成

        if (!(rt->dst.dev->features&NETIF_F_SG)) {
            unsigned int off;//如果输出网络设备不支持聚合分散I/O,则将数据复制到线性区域的剩余空间

            off = skb->len;
            if (getfrag(from, skb_put(skb, copy),
                    offset, copy, off, skb) < 0) {
                __skb_trim(skb, off);
                err = -EFAULT;
                goto error;
            }
        } else {
            int i = skb_shinfo(skb)->nr_frags;

            err = -ENOMEM;
            if (!sk_page_frag_refill(sk, pfrag))
                goto error;

            if (!skb_can_coalesce(skb, i, pfrag->page,
                          pfrag->offset)) {
                err = -EMSGSIZE;
                if (i == MAX_SKB_FRAGS)
                    goto error;

                __skb_fill_page_desc(skb, i, pfrag->page,
                             pfrag->offset, 0);
                skb_shinfo(skb)->nr_frags = ++i;
                get_page(pfrag->page);
            }
            copy = min_t(int, copy, pfrag->size - pfrag->offset);
            if (getfrag(from,
                    page_address(pfrag->page) + pfrag->offset,
                    offset, copy, skb->len, skb) < 0)
                goto error_efault;

            pfrag->offset += copy;
            skb_frag_size_add(&skb_shinfo(skb)->frags[i - 1], copy);
            skb->len += copy;
            skb->data_len += copy;
            skb->truesize += copy;
            atomic_add(copy, &sk->sk_wmem_alloc);
        }
        offset += copy;
        length -= copy;
    }

    return 0;

error_efault:
    err = -EFAULT;
error:
    cork->length -= length;
    IP_INC_STATS(sock_net(sk), IPSTATS_MIB_OUTDISCARDS);
    return err;
}