linux-kernel - Re: [PATCH net] net: prevent pulling SKB_GSO

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 15 May 2024 09:02:35 +0000
From: Lena Wang (王娜) <Lena.Wang@...iatek.com>
To: "kuba@...nel.org" <kuba@...nel.org>
CC: "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	Shiming Cheng (成诗明)
	<Shiming.Cheng@...iatek.com>, "pabeni@...hat.com" <pabeni@...hat.com>,
	"edumazet@...gle.com" <edumazet@...gle.com>,
	"willemdebruijn.kernel@...il.com" <willemdebruijn.kernel@...il.com>,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>, "matthias.bgg@...il.com"
	<matthias.bgg@...il.com>, "davem@...emloft.net" <davem@...emloft.net>
Subject: Re: [PATCH net] net: prevent pulling SKB_GSO_FRAGLIST skb

On Mon, 2024-04-29 at 06:42 -0700, Jakub Kicinski wrote:
>  	 
> External email : Please do not click links or open attachments until
> you have verified the sender or the content.
>  On Sun, 28 Apr 2024 22:29:13 +0800 shiming.cheng@...iatek.com wrote:
> > From: Shiming Cheng <shiming.cheng@...iatek.com>
> > 
> > BPF or TC callers may pull in a length longer than skb_headlen()
> > for a SKB_GSO_FRAGLIST skb. The data in fraglist will be pulled
> > into the linear space. However it destroys the skb's structure
> > and may result in an invalid segmentation or kernel exception.
> > 
> > So we should add protection to stop the operation and return
> > error to remind callers.
> 
> One of the fixes you posted breaks the
> 
>   tools/testing/selftests/net/udpgro_fwd.sh
> 
> selftest. Please investigate, and either adjust the test or the fix.

Dear Jakub,
Sorry for late response.
As we do not make selftest before, I try to build a test environmen and
cost time to apply sudo access right in our company server. Now it
blocks to generate xdp_dummy.bpf.o. Could you please give some guidline
about the script test step? Thanks.

Could you give more info about the failed situation?  
Is it this fix "[PATCH net] net: prevent pulling SKB_GSO_FRAGLIST skb"
failed?
Which case is failed?
Is it possible that the test case has issue?


>  {
> > +if (skb_is_gso(skb) &&
> > +    (skb_shinfo(skb)->gso_type & SKB_GSO_FRAGLIST) &&
> > +     write_len > skb_headlen(skb)) {
> > +return -ENOMEM;
> > +}
> > +
> 
> Most callers of skb_ensure_writable pull less than headlen.
> It might be good to start with the write_len check. Before
> looking at gso type.
> 

Dear Willem,
I will udpate as your advice in v2 as:
+if (write_len > skb_headlen(skb) && skb_is_gso(skb) &&
+    (skb_shinfo
(skb)->gso_type & SKB_GSO_FRAGLIST)) {

About selftests/net/udpgro_fwd.sh case failed, do you know the reason
or have any advice?

Thanks
Lena