netdev - Re: [PATCH RESEND net] bonding: Fix extraction of ports from the packet headers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAHn8xckHR-1n5jW8dL6AHS3DSX0TOZK87yZ-L13jo79_LjfvVg@mail.gmail.com>
Date:   Tue, 11 Jan 2022 14:23:34 +0100
From:   Jussi Maki <joamaki@...il.com>
To:     Moshe Tal <moshet@...dia.com>
Cc:     Jay Vosburgh <j.vosburgh@...il.com>,
        Veaceslav Falico <vfalico@...il.com>,
        Andy Gospodarek <andy@...yhouse.net>,
        "David S . Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>,
        Network Development <netdev@...r.kernel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        Tariq Toukan <tariqt@...dia.com>,
        Saeed Mahameed <saeedm@...dia.com>,
        Gal Pressman <gal@...dia.com>
Subject: Re: [PATCH RESEND net] bonding: Fix extraction of ports from the
 packet headers

Resending my reply as I again forgot that Gmail's mobile app doesn't
do plain text. Sorry about that.

On Mon, Jan 10, 2022 at 9:16 AM Moshe Tal <moshet@...dia.com> wrote:
>
> Wrong hash sends single stream to multiple output interfaces.
>
> The nhoff parameter is relative to skb->head, so convert it to be
> relative to skb->data for using in skb_flow_get_ports().
...
>         if (l34 && *ip_proto >= 0)
> -               fk->ports.ports = __skb_flow_get_ports(skb, *nhoff, *ip_proto, data, hlen);
> +               /* nhoff is relative to skb->head instead of the usual skb->data */
> +               fk->ports.ports = skb_flow_get_ports(skb, *nhoff - skb_headroom(skb), *ip_proto);

This will likely crash as skb can be NULL here when calculating the
hash for a xdp_buff. You'll need to make sure this code also works for
bond_xmit_hash_xdp, which passes a data pointer, but no skb to
bond_flow_dissect.

In what case was the original code broken? The flow dissector
should've used the passed in "data" pointer, but I guess in some cases
not enough data was in the linear region. The right fix is probably to
make sure "nhoff" stays relative to skb->data. The optional skb
pointer is rather unfortunate and bound to cause issues in the future.
Perhaps might be worthwhile at some point to have a more abstract
notion for a packet buffer, with xdp and skb implementations and a
flow dissector for it?

You can verify that this does not break the XDP bonding functionality
by running the xdp_bonding bpf selftest ("vmtest.sh -t ./test_progs -t
xdp_bonding" in tools/testing/selftests/bpf).