netdev - RE: [PATCH net 3/3] ice: avoid premature Rx buffer reuse

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 25 Aug 2020 09:55:24 +0000
From:   "Li,Rongqing" <lirongqing@...du.com>
To:     Björn Töpel <bjorn.topel@...il.com>,
        "jeffrey.t.kirsher@...el.com" <jeffrey.t.kirsher@...el.com>,
        "intel-wired-lan@...ts.osuosl.org" <intel-wired-lan@...ts.osuosl.org>
CC:     Björn Töpel <bjorn.topel@...el.com>,
        "magnus.karlsson@...el.com" <magnus.karlsson@...el.com>,
        "magnus.karlsson@...il.com" <magnus.karlsson@...il.com>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "maciej.fijalkowski@...el.com" <maciej.fijalkowski@...el.com>,
        "piotr.raczynski@...el.com" <piotr.raczynski@...el.com>,
        "maciej.machnikowski@...el.com" <maciej.machnikowski@...el.com>
Subject: RE: [PATCH net 3/3] ice: avoid premature Rx buffer reuse



> -----Original Message-----
> From: Björn Töpel [mailto:bjorn.topel@...il.com]
> Sent: Tuesday, August 25, 2020 5:16 PM
> To: jeffrey.t.kirsher@...el.com; intel-wired-lan@...ts.osuosl.org
> Cc: Björn Töpel <bjorn.topel@...el.com>; magnus.karlsson@...el.com;
> magnus.karlsson@...il.com; netdev@...r.kernel.org;
> maciej.fijalkowski@...el.com; piotr.raczynski@...el.com;
> maciej.machnikowski@...el.com; Li,Rongqing <lirongqing@...du.com>
> Subject: [PATCH net 3/3] ice: avoid premature Rx buffer reuse
> 
> From: Björn Töpel <bjorn.topel@...el.com>
> 
> The page recycle code, incorrectly, relied on that a page fragment could not be
> freed inside xdp_do_redirect(). This assumption leads to that page fragments
> that are used by the stack/XDP redirect can be reused and overwritten.
> 
> To avoid this, store the page count prior invoking xdp_do_redirect().
> 
> Fixes: efc2214b6047 ("ice: Add support for XDP")
> Signed-off-by: Björn Töpel <bjorn.topel@...el.com>


Reported-and-analyzed-by: Li RongQing <lirongqing@...du.com>

Thanks

-Li