netdev - Re: [net PATCH 3/4] virtio_net: fix memory leak in XDP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <2dd5f441-d6e7-368c-743f-af8f720685f8@gmail.com>
Date:   Tue, 20 Feb 2018 08:59:45 -0800
From:   John Fastabend <john.fastabend@...il.com>
To:     Jesper Dangaard Brouer <brouer@...hat.com>,
        Jason Wang <jasowang@...hat.com>
Cc:     "Michael S. Tsirkin" <mst@...hat.com>, netdev@...r.kernel.org,
        Alexei Starovoitov <alexei.starovoitov@...il.com>,
        Saeed Mahameed <saeedm@...lanox.com>,
        Daniel Borkmann <borkmann@...earbox.net>,
        "David S. Miller" <davem@...emloft.net>,
        Tariq Toukan <tariqt@...lanox.com>
Subject: Re: [net PATCH 3/4] virtio_net: fix memory leak in XDP_REDIRECT

On 02/20/2018 05:32 AM, Jesper Dangaard Brouer wrote:
> XDP_REDIRECT calling xdp_do_redirect() can fail for multiple reasons
> (which can be inspected by tracepoints). The current semantics is that
> on failure the driver calling xdp_do_redirect() must handle freeing or
> recycling the page associated with this frame.  This can be seen as an
> optimization, as drivers usually have an optimized XDP_DROP code path
> for frame recycling in place already.
> 
> The virtio_net driver didn't handle when xdp_do_redirect() failed.
> This caused a memory leak as the page refcnt wasn't decremented on
> failures.
> 
> The function __virtnet_xdp_xmit() did handle one type of failure,
> when the xmit queue virtqueue_add_outbuf() is full, which "hides"
> releasing a refcnt on the page.  Instead the function __virtnet_xdp_xmit()
> must follow API of xdp_do_redirect(), which on errors leave it up to
> the caller to free the page, of the failed send operation.
> 
> Fixes: 186b3c998c50 ("virtio-net: support XDP_REDIRECT")
> Signed-off-by: Jesper Dangaard Brouer <brouer@...hat.com>
> ---

Acked-by: John Fastabend <john.fastabend@...il.com>