linux-kernel - Re: 'skb' buffer address information leakage

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20170703222745.5f1bb399@cakuba.netronome.com>
Date:   Mon, 3 Jul 2017 22:27:45 -0700
From:   Jakub Kicinski <jakub.kicinski@...ronome.com>
To:     Dison River <pwn2river@...il.com>
Cc:     samuel@...tiz.org, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org, qca_merez@....qualcomm.com,
        kvalo@...eaurora.org, linux-wireless@...r.kernel.org,
        davem@...emloft.net, oss-drivers@...ronome.com,
        security@...nel.org, wil6210@....qualcomm.com
Subject: Re: 'skb' buffer address information leakage

On Tue, 4 Jul 2017 13:12:18 +0800, Dison River wrote:
> drivers/net/ethernet/netronome/nfp/nfp_net_debugfs.c:167
>          seq_printf(file, " frag=%p", skb);

FWIW that's actually not a skb pointer.  The structure is defined like
this:

struct nfp_net_tx_buf {
        union { 
                struct sk_buff *skb;
                void *frag;
        };
        dma_addr_t dma_addr;
        short int fidx;
        u16 pkt_cnt;
        u32 real_len;
};

So the line in question is actually reading the frag pointer, I just
reused the skb variable, because this has to be read via READ_ONCE()
and NULL-checked so I thought that doing it separately for skb and
frag is a waste of LOC especially in debug code.  I will queue up a
clean up for after the merge window.

Thanks!