| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Sat, 12 Dec 2020 06:43:34 +0000
From: wangyunjian <wangyunjian@...wei.com>
To: Willem de Bruijn <willemdebruijn.kernel@...il.com>
CC: "Michael S. Tsirkin" <mst@...hat.com>,
Jason Wang <jasowang@...hat.com>,
"virtualization@...ts.linux-foundation.org"
<virtualization@...ts.linux-foundation.org>,
Network Development <netdev@...r.kernel.org>,
"Lilijun (Jerry)" <jerry.lilijun@...wei.com>,
chenchanghu <chenchanghu@...wei.com>,
xudingke <xudingke@...wei.com>,
"huangbin (J)" <brian.huangbin@...wei.com>
Subject: RE: [PATCH net v2] tun: fix ubuf refcount incorrectly on error path
> -----Original Message-----
> From: Willem de Bruijn [mailto:willemdebruijn.kernel@...il.com]
> Sent: Wednesday, December 9, 2020 10:43 PM
> To: wangyunjian <wangyunjian@...wei.com>
> Cc: Michael S. Tsirkin <mst@...hat.com>; Jason Wang
> <jasowang@...hat.com>; virtualization@...ts.linux-foundation.org; Network
> Development <netdev@...r.kernel.org>; Lilijun (Jerry)
> <jerry.lilijun@...wei.com>; chenchanghu <chenchanghu@...wei.com>;
> xudingke <xudingke@...wei.com>
> Subject: Re: [PATCH net v2] tun: fix ubuf refcount incorrectly on error path
>
> On Wed, Dec 9, 2020 at 8:03 AM wangyunjian <wangyunjian@...wei.com>
> wrote:
> >
> > From: Yunjian Wang <wangyunjian@...wei.com>
> >
> > After setting callback for ubuf_info of skb, the callback
> > (vhost_net_zerocopy_callback) will be called to decrease the refcount
> > when freeing skb. But when an exception occurs
>
> With exception, you mean if tun_get_user returns an error that propagates to
> the sendmsg call in vhost handle_tx, correct?
Yes
>
> > afterwards, the error handling in vhost handle_tx() will try to
> > decrease the same refcount again. This is wrong and fix this by delay
> > copying ubuf_info until we're sure there's no errors.
>
> I think the right approach is to address this in the error paths, rather than
> complicate the normal datapath.
>
> Is it sufficient to suppress the call to vhost_net_ubuf_put in the handle_tx
> sendmsg error path, given that vhost_zerocopy_callback will be called on
> kfree_skb?
We can not call kfree_skb() until the skb was created.
>
> Or alternatively clear the destructor in drop:
The uarg->callback() is called immediately after we decide do datacopy
even if caller want to do zerocopy. If another error occurs later, the vhost
handle_tx() will try to decrease it again.
Thanks
>
> >
> > Fixes: 4477138fa0ae ("tun: properly test for IFF_UP")
> > Fixes: 90e33d459407 ("tun: enable napi_gro_frags() for TUN/TAP
> > driver")
> >
> > Signed-off-by: Yunjian Wang <wangyunjian@...wei.com>
> > ---
> > v2:
> > Updated code, fix by delay copying ubuf_info
> > ---
> > drivers/net/tun.c | 29 +++++++++++++++++++----------
> > 1 file changed, 19 insertions(+), 10 deletions(-)
> >
> > diff --git a/drivers/net/tun.c b/drivers/net/tun.c index
> > 2dc1988a8973..2ea822328e73 100644
> > --- a/drivers/net/tun.c
> > +++ b/drivers/net/tun.c
> > @@ -1637,6 +1637,20 @@ static struct sk_buff *tun_build_skb(struct
> tun_struct *tun,
> > return NULL;
> > }
> >
> > +/* copy ubuf_info for callback when skb has no error */ static inline
> > +void tun_copy_ubuf_info(struct sk_buff *skb, bool zerocopy, void
> > +*msg_control) {
> > + if (zerocopy) {
> > + skb_shinfo(skb)->destructor_arg = msg_control;
> > + skb_shinfo(skb)->tx_flags |= SKBTX_DEV_ZEROCOPY;
> > + skb_shinfo(skb)->tx_flags |= SKBTX_SHARED_FRAG;
> > + } else if (msg_control) {
> > + struct ubuf_info *uarg = msg_control;
> > +
> > + uarg->callback(uarg, false);
> > + }
> > +}
> > +
> > /* Get packet from user space buffer */ static ssize_t
> > tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
> > void *msg_control, struct iov_iter *from,
> > @@ -1812,16 +1826,6 @@ static ssize_t tun_get_user(struct tun_struct
> *tun, struct tun_file *tfile,
> > break;
> > }
> >
> > - /* copy skb_ubuf_info for callback when skb has no error */
> > - if (zerocopy) {
> > - skb_shinfo(skb)->destructor_arg = msg_control;
> > - skb_shinfo(skb)->tx_flags |= SKBTX_DEV_ZEROCOPY;
> > - skb_shinfo(skb)->tx_flags |= SKBTX_SHARED_FRAG;
> > - } else if (msg_control) {
> > - struct ubuf_info *uarg = msg_control;
> > - uarg->callback(uarg, false);
> > - }
> > -
> > skb_reset_network_header(skb);
> > skb_probe_transport_header(skb);
> > skb_record_rx_queue(skb, tfile->queue_index); @@ -1830,6
> > +1834,7 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct
> tun_file *tfile,
> > struct bpf_prog *xdp_prog;
> > int ret;
> >
> > + tun_copy_ubuf_info(skb, zerocopy, msg_control);
> > local_bh_disable();
> > rcu_read_lock();
> > xdp_prog = rcu_dereference(tun->xdp_prog); @@
> -1881,6
> > +1886,7 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct
> tun_file *tfile,
> > return -ENOMEM;
> > }
> >
> > + tun_copy_ubuf_info(skb, zerocopy, msg_control);
> > local_bh_disable();
> > napi_gro_frags(&tfile->napi);
> > local_bh_enable();
> > @@ -1889,6 +1895,7 @@ static ssize_t tun_get_user(struct tun_struct *tun,
> struct tun_file *tfile,
> > struct sk_buff_head *queue =
> &tfile->sk.sk_write_queue;
> > int queue_len;
> >
> > + tun_copy_ubuf_info(skb, zerocopy, msg_control);
> > spin_lock_bh(&queue->lock);
> > __skb_queue_tail(queue, skb);
> > queue_len = skb_queue_len(queue); @@ -1899,8
> +1906,10
> > @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file
> > *tfile,
> >
> > local_bh_enable();
> > } else if (!IS_ENABLED(CONFIG_4KSTACKS)) {
> > + tun_copy_ubuf_info(skb, zerocopy, msg_control);
> > tun_rx_batched(tun, tfile, skb, more);
> > } else {
> > + tun_copy_ubuf_info(skb, zerocopy, msg_control);
> > netif_rx_ni(skb);
> > }
> > rcu_read_unlock();
> > --
> > 2.23.0
> >
Powered by blists - more mailing lists