netdev - Re: [Intel-wired-lan] [bug ?] i40e_rx_buffer_flip should not be called for redirected xsk copy mode

Open Source and information security mailing list archives

Message-ID: <CAJ8uoz08pyWR43K_zhp6PsDLi0KE=y_4QTs-a7kBA-jkRQksaw@mail.gmail.com>
Date:   Mon, 6 Jul 2020 08:13:00 +0200
From:   Magnus Karlsson <magnus.karlsson@...il.com>
To:     "Li,Rongqing" <lirongqing@...du.com>
Cc:     intel-wired-lan <intel-wired-lan@...ts.osuosl.org>,
        Björn Töpel <bjorn.topel@...el.com>,
        "Karlsson, Magnus" <magnus.karlsson@...el.com>,
        Netdev <netdev@...r.kernel.org>
Subject: Re: [Intel-wired-lan] [bug ?] i40e_rx_buffer_flip should not be
 called for redirected xsk copy mode

Thank you RongQing for reporting this. I will take a look at it and
produce a patch.

/Magnus

On Thu, Jul 2, 2020 at 11:33 AM Li,Rongqing <lirongqing@...du.com> wrote:
>
> Hi:
>
>
>
> i40e_rx_buffer_flip to xsk copy mode can lead to data corruption, like the following flow:
>
>
>
> 1. first skb is not for xsk, and forwarded to another device or socket queue
>
> 2. seconds skb is for xsk, copy data to xsk memory, and page of skb->data is released
>
> 3. rx_buff is reusable since only first skb is in it, but i40e_rx_buffer_flip will make that page_offset is set to first skb data
>
> 4. then reuse rx buffer, first skb which still is living will be corrupted.
>
>
>
> -Li RongQing
>
>
>
> _______________________________________________
> Intel-wired-lan mailing list
> Intel-wired-lan@...osl.org
> https://lists.osuosl.org/mailman/listinfo/intel-wired-lan

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives