netdev - Re: [net-next PATCH] page_pool: do not release pool until inflight == 0.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 12 Nov 2019 17:23:13 +0000
From:   Alexei Starovoitov <ast@...com>
To:     Jesper Dangaard Brouer <brouer@...hat.com>,
        Jonathan Lemon <jonathan.lemon@...il.com>
CC:     "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "davem@...emloft.net" <davem@...emloft.net>,
        Kernel Team <Kernel-team@...com>,
        "ilias.apalodimas@...aro.org" <ilias.apalodimas@...aro.org>
Subject: Re: [net-next PATCH] page_pool: do not release pool until inflight ==
 0.

On 11/12/19 8:48 AM, Jesper Dangaard Brouer wrote:
>> The trace_page_pool_state_release() does not dereference pool, it just
>> reports the pointer value, so there shouldn't be any use-after-free.
> In the tracepoint we can still dereference the pool object pointer.
> This is made easier via using bpftrace for example see[1] (and with BTF
> this will become more common to do so).

bpf tracing progs cannot assume that the pointer is valid.
The program can remember a kernel pointer in a map and then
access it days later.
Like kretprobe on kfree_skb(). The skb is freed. 100% use-after-free.
Such bpf program is broken and won't be reading meaningful values,
but it won't crash the kernel.

On the other side we should not be passing pointers to freed objects
into tracepoints. That just wrong.
May be simply move that questionable tracepoint?