netdev - Re: [PATCH net-next v2 2/3] net: use skb->priority for overloading skb->dropcount and skb->reserved

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAHsH6Gv709dahHUGqXkb8CYxn+s0-4+1DGksoNfAgMksZYrt9w@mail.gmail.com>
Date:	Fri, 20 Feb 2015 13:32:48 +0200
From:	Eyal Birger <eyal.birger@...il.com>
To:	David Miller <davem@...emloft.net>
Cc:	netdev@...r.kernel.org, Eric Dumazet <edumazet@...gle.com>,
	Shmulik Ladkani <shmulik.ladkani@...il.com>
Subject: Re: [PATCH net-next v2 2/3] net: use skb->priority for overloading
 skb->dropcount and skb->reserved_tailroom instead of skb->mark

Hi,

Thanks for the review.

On Thu, Feb 19, 2015 at 10:05 PM, David Miller <davem@...emloft.net> wrote:
> From: Eyal Birger <eyal.birger@...il.com>
> Date: Thu, 12 Feb 2015 06:32:14 +0200
>
>> The purpose of overloading skb->priority is solely for retaining
>> struct sk_buff size; skb->priority is not used after the skb queued
>> to the socket and has the same guarentee of not being shared as
>> skb->mark.
>
> I don't think this analysis is accurate.
>
>> @@ -621,7 +621,7 @@ struct sk_buff {
>>                       __u16   csum_offset;
>>               };
>>       };
>> -     __u32                   priority;
>> +     __u32                   mark;
>>       int                     skb_iif;
>>       __u32                   hash;
>>       __be16                  vlan_proto;
>> @@ -636,7 +636,7 @@ struct sk_buff {
>>       __u32                   secmark;
>>  #endif
>>       union {
>> -             __u32           mark;
>> +             __u32           priority;
>>               __u32           dropcount;
>>               __u32           reserved_tailroom;
>>       };
>> --
>
> You are going to now write to dropcount in packet_rcv() and that will
> corrupt skb->priority.  If we got to packet_rcv() via
> dev_queue_xmit_nit() then that skb->priority value is actually going
> to be used by the packet schedulers for classification, flow
> scheduling, etc.

As you've mentioned below, this is not a new behavior introduced by
this patch, it was
true for skb->mark as well.

However, It seems the skb is cloned prior to setting dropcount and
other skb header
fields before it is enqueued in packet_rcv(). Would that not prevent
interference with
the transmit path?

> So I don't think this transformation is going to work properly.
>
> I'm also wondering if aliasing with skb->mark, which is what happens
> now, is legal too.

As mentioned, the case is similar for skb->mark.

Best regards,
Eyal.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html