netdev - Re: [PATCH v2] net/mlx4_en: fix potential use-after-free with dma_unmap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20180427.194859.554972405986118921.davem@davemloft.net>
Date:   Fri, 27 Apr 2018 19:48:59 -0400 (EDT)
From:   David Miller <davem@...emloft.net>
To:     srn@...mr.com
Cc:     tariqt@...lanox.com, yishaih@...lanox.com, netdev@...r.kernel.org
Subject: Re: [PATCH v2] net/mlx4_en: fix potential use-after-free with
 dma_unmap_page

From: Sarah Newman <srn@...mr.com>
Date: Wed, 25 Apr 2018 21:00:34 -0700

> When swiotlb is in use, calling dma_unmap_page means that
> the original page mapped with dma_map_page must still be valid
> as swiotlb will copy data from its internal cache back to the
> originally requested DMA location. When GRO is enabled,
> all references to the original frag may be put before
> mlx4_en_free_frag is called, meaning the page has been freed
> before the call to dma_unmap_page in mlx4_en_free_frag.
> 
> To fix, unmap the page as soon as possible.
> 
> This can be trivially detected by doing the following:
> 
> Compile the kernel with DEBUG_PAGEALLOC
> Run the kernel as a Xen Dom0
> Leave GRO enabled on the interface
> Run a 10 second or more test with iperf over the interface.
> 
> Signed-off-by: Sarah Newman <srn@...mr.com>

Tariq, I assume I will get this from you in the next set of
changes you submit to me.

Thanks.