netdev - Re: [PATCH net] net/packet: tpacket_rcv: do not increment ring index on drop

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200310023528-mutt-send-email-mst@kernel.org>
Date:   Tue, 10 Mar 2020 02:43:05 -0400
From:   "Michael S. Tsirkin" <mst@...hat.com>
To:     Willem de Bruijn <willemdebruijn.kernel@...il.com>
Cc:     netdev@...r.kernel.org, davem@...emloft.net,
        Willem de Bruijn <willemb@...gle.com>
Subject: Re: [PATCH net] net/packet: tpacket_rcv: do not increment ring index
 on drop

On Mon, Mar 09, 2020 at 11:34:35AM -0400, Willem de Bruijn wrote:
> From: Willem de Bruijn <willemb@...gle.com>
> 
> In one error case, tpacket_rcv drops packets after incrementing the
> ring producer index.
> 
> If this happens, it does not update tp_status to TP_STATUS_USER and
> thus the reader is stalled for an iteration of the ring, causing out
> of order arrival.
> 
> The only such error path is when virtio_net_hdr_from_skb fails due
> to encountering an unknown GSO type.
> 
> Signed-off-by: Willem de Bruijn <willemb@...gle.com>
> 
> ---
> 
> I wonder whether it should drop packets with unknown GSO types at all.
> This consistently blinds the reader to certain packets, including
> recent UDP and SCTP GSO types.

Ugh it looks like you have found a bug.  Consider a legacy userspace -
it was actually broken by adding USD and SCTP GSO.  I suspect the right
thing to do here is actually to split these packets up, not drop them.


> The peer function virtio_net_hdr_to_skb already drops any packets with
> unknown types, so it should be fine to add an SKB_GSO_UNKNOWN type and
> let the peer at least be aware of failure.
> 
> And possibly add SKB_GSO_UDP_L4 and SKB_GSO_SCTP types to virtio too.

This last one is possible for sure, but for virtio_net_hdr_from_skb
we'll need more flags to know whether it's safe to pass
these types to userspace.


> ---
>  net/packet/af_packet.c | 13 +++++++------
>  1 file changed, 7 insertions(+), 6 deletions(-)
> 
> diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
> index 30c6879d6774..e5b0986215d2 100644
> --- a/net/packet/af_packet.c
> +++ b/net/packet/af_packet.c
> @@ -2274,6 +2274,13 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
>  					TP_STATUS_KERNEL, (macoff+snaplen));
>  	if (!h.raw)
>  		goto drop_n_account;
> +
> +	if (do_vnet &&
> +	    virtio_net_hdr_from_skb(skb, h.raw + macoff -
> +				    sizeof(struct virtio_net_hdr),
> +				    vio_le(), true, 0))
> +		goto drop_n_account;
> +
>  	if (po->tp_version <= TPACKET_V2) {
>  		packet_increment_rx_head(po, &po->rx_ring);
>  	/*
> @@ -2286,12 +2293,6 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
>  			status |= TP_STATUS_LOSING;
>  	}
>  
> -	if (do_vnet &&
> -	    virtio_net_hdr_from_skb(skb, h.raw + macoff -
> -				    sizeof(struct virtio_net_hdr),
> -				    vio_le(), true, 0))
> -		goto drop_n_account;
> -
>  	po->stats.stats1.tp_packets++;
>  	if (copy_skb) {
>  		status |= TP_STATUS_COPY;
> -- 
> 2.25.1.481.gfbce0eb801-goog