netdev - Re: [PATCH RFC net] igc: Avoid dereference of ptr_err in igc_clean_rx

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Thu, 15 Jun 2023 16:14:15 +0200
From: Simon Horman <horms@...nel.org>
To: Maciej Fijalkowski <maciej.fijalkowski@...el.com>
Cc: Jesse Brandeburg <jesse.brandeburg@...el.com>,
	Tony Nguyen <anthony.l.nguyen@...el.com>,
	Alexei Starovoitov <ast@...nel.org>,
	Andre Guedes <andre.guedes@...el.com>,
	Dan Carpenter <dan.carpenter@...aro.org>,
	Daniel Borkmann <daniel@...earbox.net>,
	"David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Florian Kauer <florian.kauer@...utronix.de>,
	Jakub Kicinski <kuba@...nel.org>,
	Jesper Dangaard Brouer <hawk@...nel.org>,
	Jithu Joseph <jithu.joseph@...el.com>,
	John Fastabend <john.fastabend@...il.com>,
	Paolo Abeni <pabeni@...hat.com>,
	Vedang Patel <vedang.patel@...el.com>,
	intel-wired-lan@...ts.osuosl.org, netdev@...r.kernel.org,
	bpf@...r.kernel.org
Subject: Re: [PATCH RFC net] igc: Avoid dereference of ptr_err in
 igc_clean_rx_irq()

On Thu, Jun 15, 2023 at 02:09:45PM +0200, Maciej Fijalkowski wrote:
> On Thu, Jun 15, 2023 at 01:27:47PM +0200, Simon Horman wrote:
> > On Thu, Jun 15, 2023 at 11:55:29AM +0200, Maciej Fijalkowski wrote:
> > > On Thu, Jun 15, 2023 at 11:45:36AM +0200, Simon Horman wrote:
> > 
> > Hi Marciej,
> > 
> > > Hi Simon,
> > > 
> > > > In igc_clean_rx_irq() the result of a call to igc_xdp_run_prog() is assigned
> > > > to the skb local variable. This may be an ERR_PTR.
> > > > 
> > > > A little later the following is executed, which seems to be a
> > > > possible dereference of an ERR_PTR.
> > > > 
> > > > 	total_bytes += skb->len;
> > > > 
> > > > Avoid this problem by continuing the loop in which all of the
> > > > above occurs once the handling of the NULL case completes.
> > > > 
> > > > This proposed fix is speculative - I do not have deep knowledge of this
> > > > driver.  And I am concerned about the effect of skipping the following
> > > > logic:
> > > > 
> > > >   igc_put_rx_buffer(rx_ring, rx_buffer, rx_buffer_pgcnt);
> > > >   cleaned_count++;
> > > 
> > > this will break - you have to recycle the buffer to have it going.
> > 
> > Thanks. As I said I wasn't sure about the fix: it was a strawman.
> > 
> > > > Flagged by Smatch as:
> > > > 
> > > >   .../igc_main.c:2467 igc_xdp_run_prog() warn: passing zero to 'ERR_PTR'
> > > 
> > > how about PTR_ERR_OR_ZERO() ? this would silence smatch and is not an
> > > intrusive change. another way is to get rid of ERR_PTR() around skb/xdp
> > > run result but i think the former would be just fine.
> > 
> > Sorry, there were two warnings. And I accidently trimmed the one
> > that is more relevant instead of the one that is less relevant.
> > I do agree the one above does not appear to be a bug.
> > 
> > But I am concerned abut this one:
> > 
> >   .../igc_main.c:2618 igc_clean_rx_irq() error: 'skb' dereferencing possible ERR_PTR()
> > 
> > If skb is an error pointer, e.g. ERR_PTR(-IGC_XDP_PASS), and
> > it is dereferenced, that would be a problem, right?
> 
> IGC_XDP_PASS is 0. -0 is still 0 right?

Yes, I missed that point.
Though I could have chosen a different value which is not zero.

> this means skb is NULL and igc_{build,construct}_skb() will init it. For
> ERR_PTR, igc_cleanup_headers() does IS_ERR() against it and continues. So
> you will get to line 2618 only for valid skb, it just happens that logic
> is written in a way that skb is supposed to carry XDP return code. We
> removed this in ice for example but i40e works like that for many years
> without issues, AFAICT...

Thanks. I now see that the key point I was missing is the IS_ERR()
check in igc_cleanup_headers().

I agree this is not a bug.