netdev - [net-next v1 PATCH 3/4] page_pool: block alloc cache during shutdown

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 15 Nov 2019 16:06:09 +0100
From:   Jesper Dangaard Brouer <brouer@...hat.com>
To:     unlisted-recipients:; (no To-header on input)
Cc:     Toke Høiland-Jørgensen <toke@...hat.com>,
        netdev@...r.kernel.org,
        Ilias Apalodimas <ilias.apalodimas@...aro.org>,
        Jesper Dangaard Brouer <brouer@...hat.com>,
        Saeed Mahameed <saeedm@...lanox.com>,
        Matteo Croce <mcroce@...hat.com>,
        Jonathan Lemon <jonathan.lemon@...il.com>,
        Lorenzo Bianconi <lorenzo@...nel.org>,
        Tariq Toukan <tariqt@...lanox.com>
Subject: [net-next v1 PATCH 3/4] page_pool: block alloc cache during shutdown

It is documented that driver API users, have to disconnect
the page_pool, before starting shutdown phase, but is it only
documentation, there is not code catching such violations.

Given (in page_pool_empty_alloc_cache_once) alloc cache is only
flushed once, there is now an opportunity to catch this case.

This patch blocks the RX/alloc-side cache, via pretending it is
full and poison last element.  This code change will enforce that
drivers cannot use alloc cache during shutdown phase.

Signed-off-by: Jesper Dangaard Brouer <brouer@...hat.com>
---
 net/core/page_pool.c |    4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/core/page_pool.c b/net/core/page_pool.c
index e28db2ef8e12..b31f3bb7818d 100644
--- a/net/core/page_pool.c
+++ b/net/core/page_pool.c
@@ -364,6 +364,10 @@ static void page_pool_empty_alloc_cache_once(struct page_pool *pool)
 		page = pool->alloc.cache[--pool->alloc.count];
 		__page_pool_return_page(pool, page);
 	}
+
+	/* Block alloc cache, pretend it's full and poison last element */
+	pool->alloc.cache[PP_ALLOC_CACHE_SIZE - 1] = NULL;
+	pool->alloc.count = PP_ALLOC_CACHE_SIZE;
 }
 
 static void page_pool_scrub(struct page_pool *pool)