| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20241002113316.2527669-1-leitao@debian.org>
Date: Wed, 2 Oct 2024 04:32:54 -0700
From: Breno Leitao <leitao@...ian.org>
To: kuba@...nel.org,
davem@...emloft.net,
edumazet@...gle.com,
pabeni@...hat.com,
Akinobu Mita <akinobu.mita@...il.com>,
Jonathan Corbet <corbet@....net>
Cc: horms@...nel.org,
netdev@...r.kernel.org,
linux-kernel@...r.kernel.org,
Mina Almasry <almasrymina@...gle.com>,
Pavel Begunkov <asml.silence@...il.com>,
Willem de Bruijn <willemb@...gle.com>,
Alexander Lobakin <aleksander.lobakin@...el.com>,
linux-doc@...r.kernel.org (open list:DOCUMENTATION)
Subject: [PATCH net-next] net: Implement fault injection forcing skb reallocation
Introduce a fault injection mechanism to force skb reallocation. The
primary goal is to catch bugs related to pointer invalidation after
potential skb reallocation.
The fault injection mechanism aims to identify scenarios where callers
retain pointers to various headers in the skb but fail to reload these
pointers after calling a function that may reallocate the data. This
type of bug can lead to memory corruption or crashes if the old,
now-invalid pointers are used.
By forcing reallocation through fault injection, we can stress-test code
paths and ensure proper pointer management after potential skb
reallocations.
Add a hook for fault injection in the following functions:
* pskb_trim_rcsum()
* pskb_may_pull_reason()
* pskb_trim()
As the other fault injection mechanism, protect it under a debug Kconfig
called CONFIG_FAIL_SKB_FORCE_REALLOC.
This patch was *heavily* inspired by Jakub's proposal from:
https://lore.kernel.org/all/20240719174140.47a868e6@kernel.org/
CC: Akinobu Mita <akinobu.mita@...il.com>
Suggested-by: Jakub Kicinski <kuba@...nel.org>
Signed-off-by: Breno Leitao <leitao@...ian.org>
---
.../fault-injection/fault-injection.rst | 18 ++++++++++
include/linux/skbuff.h | 9 +++++
net/Kconfig.debug | 11 +++++++
net/core/Makefile | 1 +
net/core/skb_fault_injection.c | 33 +++++++++++++++++++
5 files changed, 72 insertions(+)
create mode 100644 net/core/skb_fault_injection.c
diff --git a/Documentation/fault-injection/fault-injection.rst b/Documentation/fault-injection/fault-injection.rst
index 70380a2a01b4..2fc71330c761 100644
--- a/Documentation/fault-injection/fault-injection.rst
+++ b/Documentation/fault-injection/fault-injection.rst
@@ -45,6 +45,23 @@ Available fault injection capabilities
ALLOW_ERROR_INJECTION() macro, by setting debugfs entries
under /sys/kernel/debug/fail_function. No boot option supported.
+- fail_net_force_skb_realloc
+
+ inject skb (socket buffer) reallocation events into the network path. The
+ primary goal is to identify and prevent issues related to pointer
+ mismanagement in the network subsystem. By forcing skb reallocation at
+ strategic points, this feature creates scenarios where existing pointers to
+ skb headers become invalid.
+
+ When the fault is injected and the reallocation is triggered, these pointers
+ no longer reference valid memory locations. This deliberate invalidation
+ helps expose code paths where proper pointer updating is neglected after a
+ reallocation event.
+
+ By creating these controlled fault scenarios, the system can catch instances
+ where stale pointers are used, potentially leading to memory corruption or
+ system instability.
+
- NVMe fault injection
inject NVMe status code and retry flag on devices permitted by setting
@@ -219,6 +236,7 @@ use the boot option::
fail_usercopy=
fail_make_request=
fail_futex=
+ fail_net_force_skb_realloc=
mmc_core.fail_request=<interval>,<probability>,<space>,<times>
proc entries
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 39f1d16f3628..d9ee756a64fc 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -2681,6 +2681,12 @@ static inline void skb_assert_len(struct sk_buff *skb)
#endif /* CONFIG_DEBUG_NET */
}
+#if defined(CONFIG_FAIL_SKB_FORCE_REALLOC)
+void skb_might_realloc(struct sk_buff *skb);
+#else
+static inline void skb_might_realloc(struct sk_buff *skb) {}
+#endif
+
/*
* Add data to an sk_buff
*/
@@ -2781,6 +2787,7 @@ static inline enum skb_drop_reason
pskb_may_pull_reason(struct sk_buff *skb, unsigned int len)
{
DEBUG_NET_WARN_ON_ONCE(len > INT_MAX);
+ skb_might_realloc(skb);
if (likely(len <= skb_headlen(skb)))
return SKB_NOT_DROPPED_YET;
@@ -3210,6 +3217,7 @@ static inline int __pskb_trim(struct sk_buff *skb, unsigned int len)
static inline int pskb_trim(struct sk_buff *skb, unsigned int len)
{
+ skb_might_realloc(skb);
return (len < skb->len) ? __pskb_trim(skb, len) : 0;
}
@@ -3964,6 +3972,7 @@ int pskb_trim_rcsum_slow(struct sk_buff *skb, unsigned int len);
static inline int pskb_trim_rcsum(struct sk_buff *skb, unsigned int len)
{
+ skb_might_realloc(skb);
if (likely(len >= skb->len))
return 0;
return pskb_trim_rcsum_slow(skb, len);
diff --git a/net/Kconfig.debug b/net/Kconfig.debug
index 5e3fffe707dd..f61935e028bd 100644
--- a/net/Kconfig.debug
+++ b/net/Kconfig.debug
@@ -24,3 +24,14 @@ config DEBUG_NET
help
Enable extra sanity checks in networking.
This is mostly used by fuzzers, but is safe to select.
+
+config FAIL_SKB_FORCE_REALLOC
+ bool "Fault-injection capability forcing skb to reallocate"
+ depends on FAULT_INJECTION && DEBUG_NET
+ default n
+ help
+ Provide fault-injection capability that forces the skb to be
+ reallocated, caughting possible invalid pointers to the skb.
+
+ For more information, check
+ Documentation/dev-tools/fault-injection/fault-injection.rst
diff --git a/net/core/Makefile b/net/core/Makefile
index c3ebbaf9c81e..02658807242b 100644
--- a/net/core/Makefile
+++ b/net/core/Makefile
@@ -45,3 +45,4 @@ obj-$(CONFIG_BPF_SYSCALL) += bpf_sk_storage.o
obj-$(CONFIG_OF) += of_net.o
obj-$(CONFIG_NET_TEST) += net_test.o
obj-$(CONFIG_NET_DEVMEM) += devmem.o
+obj-$(CONFIG_FAIL_SKB_FORCE_REALLOC) += skb_fault_injection.o
diff --git a/net/core/skb_fault_injection.c b/net/core/skb_fault_injection.c
new file mode 100644
index 000000000000..ccdc0f9c41be
--- /dev/null
+++ b/net/core/skb_fault_injection.c
@@ -0,0 +1,33 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include <linux/fault-inject.h>
+#include <linux/skbuff.h>
+
+static DECLARE_FAULT_ATTR(fail_net_force_skb_realloc);
+
+void skb_might_realloc(struct sk_buff *skb)
+{
+ if (should_fail(&fail_net_force_skb_realloc, 1))
+ pskb_expand_head(skb, 0, 0, GFP_ATOMIC);
+}
+EXPORT_SYMBOL(skb_might_realloc);
+
+static int __init fail_net_force_skb_realloc_setup(char *str)
+{
+ return setup_fault_attr(&fail_net_force_skb_realloc, str);
+}
+__setup("fail_net_force_skb_realloc=", fail_net_force_skb_realloc_setup);
+
+static int __init fail_net_force_skb_realloc_debugfs(void)
+{
+ struct dentry *dir;
+
+ dir = fault_create_debugfs_attr("fail_net_force_skb_realloc", NULL,
+ &fail_net_force_skb_realloc);
+ if (IS_ERR(dir))
+ return PTR_ERR(dir);
+
+ return 0;
+}
+
+late_initcall(fail_net_force_skb_realloc_debugfs);
--
2.43.5
Powered by blists - more mailing lists