netdev - Re: [PATCH net] vhost_net: examine pointer types during un-producing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 9 Mar 2018 14:21:30 +0800
From:   Jason Wang <jasowang@...hat.com>
To:     mst@...hat.com, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org
Cc:     kvm@...r.kernel.org, virtualization@...ts.linux-foundation.org,
        glider@...gle.com, dvyukov@...gle.com
Subject: Re: [PATCH net] vhost_net: examine pointer types during un-producing



On 2018年03月09日 11:16, Jason Wang wrote:
> After commit 761876c857cb ("tap: XDP support"), we can actually
> queueing XDP pointers in the pointer ring, so we should examine the
> pointer type before freeing the pointer.
>
> Fixes: 761876c857cb ("tap: XDP support")

Oops, the commit is wrong, let me repost.

Thanks

> Reported-by: Michael S. Tsirkin <mst@...hat.com>
> Signed-off-by: Jason Wang <jasowang@...hat.com>
> ---
>   drivers/net/tun.c      | 3 ++-
>   drivers/vhost/net.c    | 2 +-
>   include/linux/if_tun.h | 4 ++++
>   3 files changed, 7 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/tun.c b/drivers/net/tun.c
> index 7433bb2..28cfa64 100644
> --- a/drivers/net/tun.c
> +++ b/drivers/net/tun.c
> @@ -655,7 +655,7 @@ static struct tun_struct *tun_enable_queue(struct tun_file *tfile)
>   	return tun;
>   }
>   
> -static void tun_ptr_free(void *ptr)
> +void tun_ptr_free(void *ptr)
>   {
>   	if (!ptr)
>   		return;
> @@ -667,6 +667,7 @@ static void tun_ptr_free(void *ptr)
>   		__skb_array_destroy_skb(ptr);
>   	}
>   }
> +EXPORT_SYMBOL_GPL(tun_ptr_free);
>   
>   static void tun_queue_purge(struct tun_file *tfile)
>   {
> diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
> index 610cba2..54a138f 100644
> --- a/drivers/vhost/net.c
> +++ b/drivers/vhost/net.c
> @@ -170,7 +170,7 @@ static void vhost_net_buf_unproduce(struct vhost_net_virtqueue *nvq)
>   	if (nvq->rx_ring && !vhost_net_buf_is_empty(rxq)) {
>   		ptr_ring_unconsume(nvq->rx_ring, rxq->queue + rxq->head,
>   				   vhost_net_buf_get_size(rxq),
> -				   __skb_array_destroy_skb);
> +				   tun_ptr_free);
>   		rxq->head = rxq->tail = 0;
>   	}
>   }
> diff --git a/include/linux/if_tun.h b/include/linux/if_tun.h
> index c5b0a75..fd00170 100644
> --- a/include/linux/if_tun.h
> +++ b/include/linux/if_tun.h
> @@ -25,6 +25,7 @@ struct ptr_ring *tun_get_tx_ring(struct file *file);
>   bool tun_is_xdp_buff(void *ptr);
>   void *tun_xdp_to_ptr(void *ptr);
>   void *tun_ptr_to_xdp(void *ptr);
> +void tun_ptr_free(void *ptr);
>   #else
>   #include <linux/err.h>
>   #include <linux/errno.h>
> @@ -50,5 +51,8 @@ static inline void *tun_ptr_to_xdp(void *ptr)
>   {
>   	return NULL;
>   }
> +static inline void tun_ptr_free(void *ptr)
> +{
> +}
>   #endif /* CONFIG_TUN */
>   #endif /* __IF_TUN_H */