netdev - Re: [PATCH bpf v2] xdp: Fix handling of devmap in generic XDP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180614104959.4e4e57b8@redhat.com>
Date:   Thu, 14 Jun 2018 10:49:59 +0200
From:   Jesper Dangaard Brouer <brouer@...hat.com>
To:     Toshiaki Makita <makita.toshiaki@....ntt.co.jp>
Cc:     Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>, netdev@...r.kernel.org,
        brouer@...hat.com
Subject: Re: [PATCH bpf v2] xdp: Fix handling of devmap in generic XDP

On Thu, 14 Jun 2018 11:07:42 +0900
Toshiaki Makita <makita.toshiaki@....ntt.co.jp> wrote:

> Commit 67f29e07e131 ("bpf: devmap introduce dev_map_enqueue") changed
> the return value type of __devmap_lookup_elem() from struct net_device *
> to struct bpf_dtab_netdev * but forgot to modify generic XDP code
> accordingly.
> Thus generic XDP incorrectly used struct bpf_dtab_netdev where struct
> net_device is expected, then skb->dev was set to invalid value.
> 
> v2:
> - Fix compiler warning without CONFIG_BPF_SYSCALL.
> 
> Fixes: 67f29e07e131 ("bpf: devmap introduce dev_map_enqueue")
> Signed-off-by: Toshiaki Makita <makita.toshiaki@....ntt.co.jp>

Thanks for catching this!

Acked-by: Jesper Dangaard Brouer <brouer@...hat.com>

Notice, that the current code works (and does not crash), but it is
pure luck.  Because struct bpf_dtab_netdev happen to have the
net_device as the first member.

struct bpf_dtab_netdev {
	struct net_device *dev; /* must be first member, due to tracepoint */
	struct bpf_dtab *dtab;
	unsigned int bit;
	struct xdp_bulk_queue __percpu *bulkq;
	struct rcu_head rcu;
};

-- 
Best regards,
  Jesper Dangaard Brouer
  MSc.CS, Principal Kernel Engineer at Red Hat
  LinkedIn: http://www.linkedin.com/in/brouer