netdev - Re: [PATCH net] tcp: fix page frag corruption on page fault

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 26 Nov 2021 17:04:47 +0100
From:   Paolo Abeni <pabeni@...hat.com>
To:     Eric Dumazet <edumazet@...gle.com>
Cc:     netdev@...r.kernel.org, Steffen Froemer <sfroemer@...hat.com>
Subject: Re: [PATCH net] tcp: fix page frag corruption on page fault

Hello,

On Fri, 2021-11-26 at 07:32 -0800, Eric Dumazet wrote:
> On Fri, Nov 26, 2021 at 7:27 AM Eric Dumazet <edumazet@...gle.com> wrote:
> 
> > We need to find one flag that can ask  gfpflags_normal_context() to
> > return false for this case.
> > 
> > Or if too difficult, stop only using sk->sk_allocation to decide
> > between the per-thread frag, or the per socket one.
> > 
> > I presume there are few active CIFS sockets on a host. They should use
> > a per socket sk_frag.
> > 
> 
> A pure networking change could be to use a new MSG_  flag to force sendmsg()
> to use the sk->sk_frag, but that would add yet another test in TCP fast path.
> 
> About gfpflags_normal_context being used by dlm : we can simply add our own
> helper with a new name describing that we want:
> 
> Both being in process context, and not from page fault handler .

Thanks for the hints! I'm testing the following (replacing the helper
with direct usage of a suitable check). Plus some adjusting to the
sk_page_frag() description.

Paolo
---
diff --git a/include/net/sock.h b/include/net/sock.h
index b32906e1ab55..8ae6fecfa18c 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -2442,7 +2442,8 @@ static inline void sk_stream_moderate_sndbuf(struct sock *sk)
  */
 static inline struct page_frag *sk_page_frag(struct sock *sk)
 {
-       if (gfpflags_normal_context(sk->sk_allocation))
+       if ((sk->sk_allocation & (__GFP_DIRECT_RECLAIM | __GFP_MEMALLOC | __GFP_FS)) ==
+           (__GFP_DIRECT_RECLAIM | __GFP_FS))
                return &current->task_frag;
 
        return &sk->sk_frag;