netdev - Re: [PATCH net v3] virtio_net: fix wrong buf address calculation when using xdp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <00a5d84e-298e-3ca4-c6da-826e6fe586de@iogearbox.net>
Date:   Mon, 25 Apr 2022 15:10:33 +0200
From:   Daniel Borkmann <daniel@...earbox.net>
To:     Nikolay Aleksandrov <razor@...ckwall.org>, netdev@...r.kernel.org
Cc:     kuba@...nel.org, davem@...emloft.net, stable@...r.kernel.org,
        Jason Wang <jasowang@...hat.com>,
        Xuan Zhuo <xuanzhuo@...ux.alibaba.com>,
        "Michael S. Tsirkin" <mst@...hat.com>,
        virtualization@...ts.linux-foundation.org
Subject: Re: [PATCH net v3] virtio_net: fix wrong buf address calculation when
 using xdp

On 4/25/22 12:37 PM, Nikolay Aleksandrov wrote:
> We received a report[1] of kernel crashes when Cilium is used in XDP
> mode with virtio_net after updating to newer kernels. After
> investigating the reason it turned out that when using mergeable bufs
> with an XDP program which adjusts xdp.data or xdp.data_meta page_to_buf()
> calculates the build_skb address wrong because the offset can become less
> than the headroom so it gets the address of the previous page (-X bytes
> depending on how lower offset is):
>   page_to_skb: page addr ffff9eb2923e2000 buf ffff9eb2923e1ffc offset 252 headroom 256
[...]
> CC: stable@...r.kernel.org
> CC: Jason Wang <jasowang@...hat.com>
> CC: Xuan Zhuo <xuanzhuo@...ux.alibaba.com>
> CC: Daniel Borkmann <daniel@...earbox.net>
> CC: "Michael S. Tsirkin" <mst@...hat.com>
> CC: virtualization@...ts.linux-foundation.org
> Fixes: 8fb7da9e9907 ("virtio_net: get build_skb() buf by data ptr")
> Signed-off-by: Nikolay Aleksandrov <razor@...ckwall.org>

Thanks everyone!

Acked-by: Daniel Borkmann <daniel@...earbox.net>