netdev - Re: [PATCH bpf] xsk: fix registration of Rx-only sockets

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 23 Oct 2019 16:03:48 -0700
From:   "Jonathan Lemon" <jonathan.lemon@...il.com>
To:     "Magnus Karlsson" <magnus.karlsson@...el.com>
Cc:     bjorn.topel@...el.com, ast@...nel.org, daniel@...earbox.net,
        netdev@...r.kernel.org, kal.conley@...tris.com, bpf@...r.kernel.org
Subject: Re: [PATCH bpf] xsk: fix registration of Rx-only sockets

On 21 Oct 2019, at 1:16, Magnus Karlsson wrote:

> Having Rx-only AF_XDP sockets can potentially lead to a crash in the
> system by a NULL pointer dereference in xsk_umem_consume_tx(). This
> function iterates through a list of all sockets tied to a umem and
> checks if there are any packets to send on the Tx ring. Rx-only
> sockets do not have a Tx ring, so this will cause a NULL pointer
> dereference. This will happen if you have registered one or more
> Rx-only sockets to a umem and the driver is checking the Tx ring even
> on Rx, or if the XDP_SHARED_UMEM mode is used and there is a mix of
> Rx-only and other sockets tied to the same umem.
>
> Fixed by only putting sockets with a Tx component on the list that
> xsk_umem_consume_tx() iterates over.

A future improvement might be renaming umem->xsk_list to umem->xsk_tx_list
or similar, in order to make it clear that the list is only used on the
TX path.

>
> Fixes: ac98d8aab61b ("xsk: wire upp Tx zero-copy functions")
> Reported-by: Kal Cutter Conley <kal.conley@...tris.com>
> Signed-off-by: Magnus Karlsson <magnus.karlsson@...el.com>

Acked-by: Jonathan Lemon <jonathan.lemon@...il.com>

-- 
Jonathan