linux-kernel - Re: [PATCH net] vhost_net: examine pointer types during un-producing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180309055424-mutt-send-email-mst@kernel.org>
Date:   Fri, 9 Mar 2018 05:54:30 +0200
From:   "Michael S. Tsirkin" <mst@...hat.com>
To:     Jason Wang <jasowang@...hat.com>
Cc:     netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
        kvm@...r.kernel.org, virtualization@...ts.linux-foundation.org,
        glider@...gle.com, dvyukov@...gle.com
Subject: Re: [PATCH net] vhost_net: examine pointer types during un-producing

On Fri, Mar 09, 2018 at 11:16:22AM +0800, Jason Wang wrote:
> After commit 761876c857cb ("tap: XDP support"), we can actually
> queueing XDP pointers in the pointer ring, so we should examine the
> pointer type before freeing the pointer.
> 
> Fixes: 761876c857cb ("tap: XDP support")
> Reported-by: Michael S. Tsirkin <mst@...hat.com>
> Signed-off-by: Jason Wang <jasowang@...hat.com>

Acked-by: Michael S. Tsirkin <mst@...hat.com>

> ---
>  drivers/net/tun.c      | 3 ++-
>  drivers/vhost/net.c    | 2 +-
>  include/linux/if_tun.h | 4 ++++
>  3 files changed, 7 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/tun.c b/drivers/net/tun.c
> index 7433bb2..28cfa64 100644
> --- a/drivers/net/tun.c
> +++ b/drivers/net/tun.c
> @@ -655,7 +655,7 @@ static struct tun_struct *tun_enable_queue(struct tun_file *tfile)
>  	return tun;
>  }
>  
> -static void tun_ptr_free(void *ptr)
> +void tun_ptr_free(void *ptr)
>  {
>  	if (!ptr)
>  		return;
> @@ -667,6 +667,7 @@ static void tun_ptr_free(void *ptr)
>  		__skb_array_destroy_skb(ptr);
>  	}
>  }
> +EXPORT_SYMBOL_GPL(tun_ptr_free);
>  
>  static void tun_queue_purge(struct tun_file *tfile)
>  {
> diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
> index 610cba2..54a138f 100644
> --- a/drivers/vhost/net.c
> +++ b/drivers/vhost/net.c
> @@ -170,7 +170,7 @@ static void vhost_net_buf_unproduce(struct vhost_net_virtqueue *nvq)
>  	if (nvq->rx_ring && !vhost_net_buf_is_empty(rxq)) {
>  		ptr_ring_unconsume(nvq->rx_ring, rxq->queue + rxq->head,
>  				   vhost_net_buf_get_size(rxq),
> -				   __skb_array_destroy_skb);
> +				   tun_ptr_free);
>  		rxq->head = rxq->tail = 0;
>  	}
>  }
> diff --git a/include/linux/if_tun.h b/include/linux/if_tun.h
> index c5b0a75..fd00170 100644
> --- a/include/linux/if_tun.h
> +++ b/include/linux/if_tun.h
> @@ -25,6 +25,7 @@ struct ptr_ring *tun_get_tx_ring(struct file *file);
>  bool tun_is_xdp_buff(void *ptr);
>  void *tun_xdp_to_ptr(void *ptr);
>  void *tun_ptr_to_xdp(void *ptr);
> +void tun_ptr_free(void *ptr);
>  #else
>  #include <linux/err.h>
>  #include <linux/errno.h>
> @@ -50,5 +51,8 @@ static inline void *tun_ptr_to_xdp(void *ptr)
>  {
>  	return NULL;
>  }
> +static inline void tun_ptr_free(void *ptr)
> +{
> +}
>  #endif /* CONFIG_TUN */
>  #endif /* __IF_TUN_H */
> -- 
> 2.7.4