netdev - Re: panic at sock_zerocopy_put when I ssh into a VM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 8 Aug 2017 22:01:49 -0700
From:   Willem de Bruijn <willemdebruijn.kernel@...il.com>
To:     David Ahern <dsahern@...il.com>
Cc:     Willem de Bruijn <willemb@...gle.com>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: Re: panic at sock_zerocopy_put when I ssh into a VM

On Tue, Aug 8, 2017 at 9:48 PM, Willem de Bruijn
<willemdebruijn.kernel@...il.com> wrote:
> Thanks for the report, David, and sorry for the breakage.
>
> I am not able to reproduce the issue with my qemu setup with vhost-net
> with experimental_zcopytx so far.

I did just reproduce the (well, a) panic in sock_zerocopy_put. It is
indeed in the mm_unaccount_pinned_pages code that tests
uarg->mmp:

(gdb) list *(sock_zerocopy_put+0x26)
0xffffffff81620316 is in sock_zerocopy_put (net/core/skbuff.c:933).
928     }
929
930     static void mm_unaccount_pinned_pages(struct mmpin *mmp)
931     {
932             if (mmp->user) {
933                     atomic_long_sub(mmp->num_pg, &mmp->user->locked_vm);
934                     free_uid(mmp->user);

This gives me more confidence that the previous fix is sufficient.
I will have to revise it to avoid this path for all zerocopy paths
besides msg_zerocopy.