netdev - Re: [PATCH bpf] xsk: fix registration of Rx-only sockets

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAADnVQKYME2GgSPs_DTS97c05BT=L49KJ+XUXEStgK5Sg3UOmA@mail.gmail.com>
Date:   Thu, 24 Oct 2019 08:19:30 -0700
From:   Alexei Starovoitov <alexei.starovoitov@...il.com>
To:     Magnus Karlsson <magnus.karlsson@...il.com>
Cc:     Jonathan Lemon <jonathan.lemon@...il.com>,
        Magnus Karlsson <magnus.karlsson@...el.com>,
        Björn Töpel <bjorn.topel@...el.com>,
        Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        Network Development <netdev@...r.kernel.org>,
        Kal Cutter Conley <kal.conley@...tris.com>,
        bpf <bpf@...r.kernel.org>
Subject: Re: [PATCH bpf] xsk: fix registration of Rx-only sockets

On Thu, Oct 24, 2019 at 5:53 AM Magnus Karlsson
<magnus.karlsson@...il.com> wrote:
>
> On Thu, Oct 24, 2019 at 12:47 PM Jonathan Lemon
> <jonathan.lemon@...il.com> wrote:
> >
> > On 21 Oct 2019, at 1:16, Magnus Karlsson wrote:
> >
> > > Having Rx-only AF_XDP sockets can potentially lead to a crash in the
> > > system by a NULL pointer dereference in xsk_umem_consume_tx(). This
> > > function iterates through a list of all sockets tied to a umem and
> > > checks if there are any packets to send on the Tx ring. Rx-only
> > > sockets do not have a Tx ring, so this will cause a NULL pointer
> > > dereference. This will happen if you have registered one or more
> > > Rx-only sockets to a umem and the driver is checking the Tx ring even
> > > on Rx, or if the XDP_SHARED_UMEM mode is used and there is a mix of
> > > Rx-only and other sockets tied to the same umem.
> > >
> > > Fixed by only putting sockets with a Tx component on the list that
> > > xsk_umem_consume_tx() iterates over.
> >
> > A future improvement might be renaming umem->xsk_list to umem->xsk_tx_list
> > or similar, in order to make it clear that the list is only used on the
> > TX path.
>
> Agreed. Had that exact name in my first internal version of the patch
> :-), but that rename touched a lot of places so it obfuscated the fix
> and therefore I removed it to make it clearer. But I can submit a
> patch with the rename to bpf-next.

please do so after bpf fixes will travel to net->linus->net-next->bpf-next
Dealing with merge conflicts is not worth it otherwise.