netdev - Re: [PATCH 5/5] skbuff: skb_segment: orphan frags before copying

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20140310220717.GA7150@redhat.com>
Date:	Tue, 11 Mar 2014 00:07:17 +0200
From:	"Michael S. Tsirkin" <mst@...hat.com>
To:	Herbert Xu <herbert@...dor.apana.org.au>
Cc:	linux-kernel@...r.kernel.org, jbenc@...hat.com,
	David Miller <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Daniel Borkmann <dborkman@...hat.com>,
	Simon Horman <horms@...ge.net.au>,
	Paul Durrant <Paul.Durrant@...rix.com>,
	Thomas Graf <tgraf@...g.ch>, Miklos Szeredi <mszeredi@...e.cz>,
	=?UTF-8?q?Peter=20Pan=28=E6=BD=98=E5=8D=AB=E5=B9=B3=29?= <panweiping3@...il.com>,
	netdev@...r.kernel.org
Subject: Re: [PATCH 5/5] skbuff: skb_segment: orphan frags before copying

On Tue, Mar 11, 2014 at 05:56:40AM +0800, Herbert Xu wrote:
> On Mon, Mar 10, 2014 at 11:52:36PM +0200, Michael S. Tsirkin wrote:
> >
> > The cover letter has more detail:
> 
> For some reason I didn't receive this cover letter.
> > 	skb_segment ... moves frags
> > 	between skbs without orphaning them.
> > 	This causes userspace to assume it's safe to
> > 	reuse the buffer, and receiver gets corrupted data.
> > 	This further might leak information from the
> > 	transmitter on the wire.
> > 
> > if still unclear, pls let me know.
> 
> Why can't we deal with this by simply postponing the copy until
> later?
> 
> Thanks,

Once one skb completes the callback is invoked and userspace
reuses this buffer for something else.
At that point it's too late to do the copy.


> IOW if we pass along SKBTX_SHARED_FRAG will it work?

I don't see how would SKBTX_SHARED_FRAG help with this at all.
That only works for pages gifted to kernel by e.g. vmsplice
that aren't reused by userspace.


> -- 
> Email: Herbert Xu <herbert@...dor.apana.org.au>
> Home Page: http://gondor.apana.org.au/~herbert/
> PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html