| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Tue, 7 Jan 2020 10:33:55 +0000
From: Sergey Dyasli <sergey.dyasli@...rix.com>
To: "Durrant, Paul" <pdurrant@...zon.com>,
"xen-devel@...ts.xen.org" <xen-devel@...ts.xen.org>,
"kasan-dev@...glegroups.com" <kasan-dev@...glegroups.com>,
"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
CC: Juergen Gross <jgross@...e.com>,
Stefano Stabellini <sstabellini@...nel.org>,
George Dunlap <george.dunlap@...rix.com>,
"Ross Lagerwall" <ross.lagerwall@...rix.com>,
Alexander Potapenko <glider@...gle.com>,
Andrey Ryabinin <aryabinin@...tuozzo.com>,
"Boris Ostrovsky" <boris.ostrovsky@...cle.com>,
Dmitry Vyukov <dvyukov@...gle.com>,
"sergey.dyasli@...rix.com >> Sergey Dyasli"
<sergey.dyasli@...rix.com>
Subject: Re: [Xen-devel] [RFC PATCH 3/3] xen/netback: Fix grant copy across
page boundary with KASAN
On 17/12/2019 15:14, Durrant, Paul wrote:
>> -----Original Message-----
>> From: Xen-devel <xen-devel-bounces@...ts.xenproject.org> On Behalf Of
>> Sergey Dyasli
>> Sent: 17 December 2019 14:08
>> To: xen-devel@...ts.xen.org; kasan-dev@...glegroups.com; linux-
>> kernel@...r.kernel.org
>> Cc: Juergen Gross <jgross@...e.com>; Sergey Dyasli
>> <sergey.dyasli@...rix.com>; Stefano Stabellini <sstabellini@...nel.org>;
>> George Dunlap <george.dunlap@...rix.com>; Ross Lagerwall
>> <ross.lagerwall@...rix.com>; Alexander Potapenko <glider@...gle.com>;
>> Andrey Ryabinin <aryabinin@...tuozzo.com>; Boris Ostrovsky
>> <boris.ostrovsky@...cle.com>; Dmitry Vyukov <dvyukov@...gle.com>
>> Subject: [Xen-devel] [RFC PATCH 3/3] xen/netback: Fix grant copy across
>> page boundary with KASAN
>>
>> From: Ross Lagerwall <ross.lagerwall@...rix.com>
>>
>> When KASAN (or SLUB_DEBUG) is turned on, the normal expectation that
>> allocations are aligned to the next power of 2 of the size does not
>> hold. Therefore, handle grant copies that cross page boundaries.
>>
>> Signed-off-by: Ross Lagerwall <ross.lagerwall@...rix.com>
>> Signed-off-by: Sergey Dyasli <sergey.dyasli@...rix.com>
>
> Would have been nice to cc netback maintainers...
Sorry, I'll try to be more careful next time.
>
>> ---
>> drivers/net/xen-netback/common.h | 2 +-
>> drivers/net/xen-netback/netback.c | 55 ++++++++++++++++++++++++-------
>> 2 files changed, 45 insertions(+), 12 deletions(-)
>>
>> diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-
>> netback/common.h
>> index 05847eb91a1b..e57684415edd 100644
>> --- a/drivers/net/xen-netback/common.h
>> +++ b/drivers/net/xen-netback/common.h
>> @@ -155,7 +155,7 @@ struct xenvif_queue { /* Per-queue data for xenvif */
>> struct pending_tx_info pending_tx_info[MAX_PENDING_REQS];
>> grant_handle_t grant_tx_handle[MAX_PENDING_REQS];
>>
>> - struct gnttab_copy tx_copy_ops[MAX_PENDING_REQS];
>> + struct gnttab_copy tx_copy_ops[MAX_PENDING_REQS * 2];
>> struct gnttab_map_grant_ref tx_map_ops[MAX_PENDING_REQS];
>> struct gnttab_unmap_grant_ref tx_unmap_ops[MAX_PENDING_REQS];
>> /* passed to gnttab_[un]map_refs with pages under (un)mapping */
>> diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-
>> netback/netback.c
>> index 0020b2e8c279..1541b6e0cc62 100644
>> --- a/drivers/net/xen-netback/netback.c
>> +++ b/drivers/net/xen-netback/netback.c
>> @@ -320,6 +320,7 @@ static int xenvif_count_requests(struct xenvif_queue
>> *queue,
>>
>> struct xenvif_tx_cb {
>> u16 pending_idx;
>> + u8 copies;
>> };
>
> I know we're a way off the limit (48 bytes) but I wonder if we ought to have a compile time check here that we're not overflowing skb->cb.
I will add a BUILD_BUG_ON()
>
>>
>> #define XENVIF_TX_CB(skb) ((struct xenvif_tx_cb *)(skb)->cb)
>> @@ -439,6 +440,7 @@ static int xenvif_tx_check_gop(struct xenvif_queue
>> *queue,
>> {
>> struct gnttab_map_grant_ref *gop_map = *gopp_map;
>> u16 pending_idx = XENVIF_TX_CB(skb)->pending_idx;
>> + u8 copies = XENVIF_TX_CB(skb)->copies;
>> /* This always points to the shinfo of the skb being checked, which
>> * could be either the first or the one on the frag_list
>> */
>> @@ -450,23 +452,27 @@ static int xenvif_tx_check_gop(struct xenvif_queue
>> *queue,
>> int nr_frags = shinfo->nr_frags;
>> const bool sharedslot = nr_frags &&
>> frag_get_pending_idx(&shinfo->frags[0]) ==
>> pending_idx;
>> - int i, err;
>> + int i, err = 0;
>>
>> - /* Check status of header. */
>> - err = (*gopp_copy)->status;
>> - if (unlikely(err)) {
>> - if (net_ratelimit())
>> - netdev_dbg(queue->vif->dev,
>> + while (copies) {
>> + /* Check status of header. */
>> + int newerr = (*gopp_copy)->status;
>> + if (unlikely(newerr)) {
>> + if (net_ratelimit())
>> + netdev_dbg(queue->vif->dev,
>> "Grant copy of header failed! status: %d
>> pending_idx: %u ref: %u\n",
>> (*gopp_copy)->status,
>> pending_idx,
>> (*gopp_copy)->source.u.ref);
>> - /* The first frag might still have this slot mapped */
>> - if (!sharedslot)
>> - xenvif_idx_release(queue, pending_idx,
>> - XEN_NETIF_RSP_ERROR);
>> + /* The first frag might still have this slot mapped */
>> + if (!sharedslot && !err)
>> + xenvif_idx_release(queue, pending_idx,
>> + XEN_NETIF_RSP_ERROR);
>
> Can't this be done after the loop, if there is an accumulated err? I think it would make the code slightly neater.
Looks like xenvif_idx_release() indeed wants to be just after the loop.
>
>> + err = newerr;
>> + }
>> + (*gopp_copy)++;
>> + copies--;
>> }
>> - (*gopp_copy)++;
>>
>> check_frags:
>> for (i = 0; i < nr_frags; i++, gop_map++) {
>> @@ -910,6 +916,7 @@ static void xenvif_tx_build_gops(struct xenvif_queue
>> *queue,
>> xenvif_tx_err(queue, &txreq, extra_count, idx);
>> break;
>> }
>> + XENVIF_TX_CB(skb)->copies = 0;
>>
>> skb_shinfo(skb)->nr_frags = ret;
>> if (data_len < txreq.size)
>> @@ -933,6 +940,7 @@ static void xenvif_tx_build_gops(struct xenvif_queue
>> *queue,
>> "Can't allocate the frag_list
>> skb.\n");
>> break;
>> }
>> + XENVIF_TX_CB(nskb)->copies = 0;
>> }
>>
>> if (extras[XEN_NETIF_EXTRA_TYPE_GSO - 1].type) {
>> @@ -990,6 +998,31 @@ static void xenvif_tx_build_gops(struct xenvif_queue
>> *queue,
>>
>> queue->tx_copy_ops[*copy_ops].len = data_len;
>
> If offset_in_page(skb->data)+ data_len can exceed XEN_PAGE_SIZE, does this not need to be truncated?
It is performed as the first thing inside the if condition below.
>> queue->tx_copy_ops[*copy_ops].flags = GNTCOPY_source_gref;
>> + XENVIF_TX_CB(skb)->copies++;
>> +
>> + if (offset_in_page(skb->data) + data_len > XEN_PAGE_SIZE) {
>> + unsigned int extra_len = offset_in_page(skb->data) +
>> + data_len - XEN_PAGE_SIZE;
>> +
>> + queue->tx_copy_ops[*copy_ops].len -= extra_len;
>> + (*copy_ops)++;
>> +
>> + queue->tx_copy_ops[*copy_ops].source.u.ref = txreq.gref;
>> + queue->tx_copy_ops[*copy_ops].source.domid =
>> + queue->vif->domid;
>> + queue->tx_copy_ops[*copy_ops].source.offset =
>> + txreq.offset + data_len - extra_len;
>> +
>> + queue->tx_copy_ops[*copy_ops].dest.u.gmfn =
>> + virt_to_gfn(skb->data + data_len - extra_len);
>> + queue->tx_copy_ops[*copy_ops].dest.domid = DOMID_SELF;
>> + queue->tx_copy_ops[*copy_ops].dest.offset = 0;
>> +
>> + queue->tx_copy_ops[*copy_ops].len = extra_len;
>> + queue->tx_copy_ops[*copy_ops].flags =
>> GNTCOPY_source_gref;
>> +
>> + XENVIF_TX_CB(skb)->copies++;
>> + }
>>
>> (*copy_ops)++;
>>
>> --
>> 2.17.1
>>
>>
>> _______________________________________________
>> Xen-devel mailing list
>> Xen-devel@...ts.xenproject.org
>> https://lists.xenproject.org/mailman/listinfo/xen-devel
Powered by blists - more mailing lists