netdev - Re: [PATCH bpf] bpf: devmap: fix wrong interface selection in notifier

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 24 Oct 2018 11:07:30 +0200
From:   Daniel Borkmann <daniel@...earbox.net>
To:     Taehee Yoo <ap420073@...il.com>, ast@...nel.org
Cc:     netdev@...r.kernel.org, john.fastabend@...il.com
Subject: Re: [PATCH bpf] bpf: devmap: fix wrong interface selection in
 notifier_call

[ +John ]

On 10/22/2018 05:41 PM, Taehee Yoo wrote:
> The dev_map_notification() removes interface in devmap if
> unregistering interface's ifindex is same.
> But only checking ifindex is not enough because other netns can have
> same ifindex. so that wrong interface selection could occurred.
> Hence the net_eq() is needed.
> 
> Fixes: 2ddf71e23cc2 ("net: add notifier hooks for devmap bpf map")
> Signed-off-by: Taehee Yoo <ap420073@...il.com>
> ---
>  kernel/bpf/devmap.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/kernel/bpf/devmap.c b/kernel/bpf/devmap.c
> index 141710b82a6c..0d9211e49a4a 100644
> --- a/kernel/bpf/devmap.c
> +++ b/kernel/bpf/devmap.c
> @@ -496,6 +496,7 @@ static int dev_map_notification(struct notifier_block *notifier,
>  				ulong event, void *ptr)
>  {
>  	struct net_device *netdev = netdev_notifier_info_to_dev(ptr);
> +	struct net *net = dev_net(netdev);
>  	struct bpf_dtab *dtab;
>  	int i;
>  
> @@ -512,7 +513,7 @@ static int dev_map_notification(struct notifier_block *notifier,
>  				struct bpf_dtab_netdev *dev, *odev;
>  
>  				dev = READ_ONCE(dtab->netdev_map[i]);
> -				if (!dev ||
> +				if (!dev || !net_eq(net, dev_net(dev->dev)) ||
>  				    dev->dev->ifindex != netdev->ifindex)

Can't we just compare netdev pointers directly here?

>  					continue;
>  				odev = cmpxchg(&dtab->netdev_map[i], dev, NULL);
>