netdev - Re: [PATCH net-next v10 08/16] tls: Inline do_tcp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20230803201212.1d5dd0f9@kernel.org>
Date: Thu, 3 Aug 2023 20:12:12 -0700
From: Jakub Kicinski <kuba@...nel.org>
To: Tariq Toukan <ttoukan.linux@...il.com>
Cc: David Howells <dhowells@...hat.com>, netdev@...r.kernel.org, "David S.
 Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, Paolo
 Abeni <pabeni@...hat.com>, Willem de Bruijn
 <willemdebruijn.kernel@...il.com>, David Ahern <dsahern@...nel.org>,
 Matthew Wilcox <willy@...radead.org>, Al Viro <viro@...iv.linux.org.uk>,
 Christoph Hellwig <hch@...radead.org>, Jens Axboe <axboe@...nel.dk>, Jeff
 Layton <jlayton@...nel.org>, Christian Brauner <brauner@...nel.org>, Chuck
 Lever III <chuck.lever@...cle.com>, Linus Torvalds
 <torvalds@...ux-foundation.org>, linux-fsdevel@...r.kernel.org,
 linux-kernel@...r.kernel.org, linux-mm@...ck.org, Boris Pismenny
 <borisp@...dia.com>, John Fastabend <john.fastabend@...il.com>, Gal
 Pressman <gal@...dia.com>, ranro@...dia.com, samiram@...dia.com,
 drort@...dia.com, Tariq Toukan <tariqt@...dia.com>
Subject: Re: [PATCH net-next v10 08/16] tls: Inline do_tcp_sendpages()

On Thu, 3 Aug 2023 14:47:35 +0300 Tariq Toukan wrote:
> When applying this patch, repro disappears! :)
> Apparently it is related to the warning.
> Please go on and submit it.

I have no idea how. I found a different bug, staring at this code
for another hour. But I still don't get how we can avoid UaF on
a page by having the TCP take a ref on it rather than copy it.

If anything we should have 2 refs on any page in the sg, one because
it's on the sg, and another held by the re-tx handling.

So I'm afraid we're papering over something here :( We need to keep
digging.