netdev - Re: [PATCH v5] skbuff: Fix a race between coalescing and releasing SKBs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 14 Apr 2023 09:41:02 +0800
From:   Yunsheng Lin <linyunsheng@...wei.com>
To:     Eric Dumazet <edumazet@...gle.com>
CC:     Liang Chen <liangchen.linux@...il.com>, <kuba@...nel.org>,
        <ilias.apalodimas@...aro.org>, <hawk@...nel.org>,
        <netdev@...r.kernel.org>, <davem@...emloft.net>,
        <pabeni@...hat.com>, <alexander.duyck@...il.com>
Subject: Re: [PATCH v5] skbuff: Fix a race between coalescing and releasing
 SKBs

On 2023/4/13 21:45, Eric Dumazet wrote:
> On Thu, Apr 13, 2023 at 1:42 PM Yunsheng Lin <linyunsheng@...wei.com> wrote:
>>
>> On 2023/4/13 17:03, Liang Chen wrote:
> 
>>> Fixes: 53e0961da1c7 ("page_pool: add frag page recycling support in page pool")
>>
>> I am not quite sure the above is right Fixes tag.
>> As 1effe8ca4e34 ("skbuff: fix coalescing for page_pool fragment recycling") has tried
>> to fix it, and it missed the case this patch is fixing, so we need another fix here.
> 
> The Fixes: tag is more about pointing to stable teams how to deal with
> backports.
> There is no point giving the full chain, because this 'blamed' commit is enough.
> 
> If an old kernel does not contain this commit, there is no point trying harder.

In that case, it may be better to point to
6a5bcd84e886 ("page_pool: Allow drivers to hint on SKB recycling") too.

As even without fragment support, for below case:
to->pp_recycle    --> true
from->pp_recycle  --> true
skb_cloned(from)  --> true

It seems some page may be called with page_pool_release_page() twice if 'to' and
cloned skb of 'from' are freed concurrently, as there is data race between checking
page->pp_magic and clearing page->pp_magic.

Anyway, as it is merged already, I guess it is not really matter anymore.


> .
>