lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAHS8izO0ADnYqKczEkfNts2VLDfiYEkQ=AzJ-xzb+Kh2ZpFjbg@mail.gmail.com> Date: Tue, 19 Dec 2023 15:24:49 -0800 From: Mina Almasry <almasrymina@...gle.com> To: David Wei <dw@...idwei.uk> Cc: io-uring@...r.kernel.org, netdev@...r.kernel.org, Jens Axboe <axboe@...nel.dk>, Pavel Begunkov <asml.silence@...il.com>, Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, "David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, Jesper Dangaard Brouer <hawk@...nel.org>, David Ahern <dsahern@...nel.org> Subject: Re: [RFC PATCH v3 02/20] tcp: don't allow non-devmem originated ppiov On Tue, Dec 19, 2023 at 1:04 PM David Wei <dw@...idwei.uk> wrote: > > From: Pavel Begunkov <asml.silence@...il.com> > > NOT FOR UPSTREAM > > There will be more users of struct page_pool_iov, and ppiovs from one > subsystem must not be used by another. That should never happen for any > sane application, but we need to enforce it in case of bufs and/or > malicious users. > > Signed-off-by: Pavel Begunkov <asml.silence@...il.com> > Signed-off-by: David Wei <dw@...idwei.uk> > --- > net/ipv4/tcp.c | 7 +++++++ > 1 file changed, 7 insertions(+) > > diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c > index 33a8bb63fbf5..9c6b18eebb5b 100644 > --- a/net/ipv4/tcp.c > +++ b/net/ipv4/tcp.c > @@ -2384,6 +2384,13 @@ static int tcp_recvmsg_devmem(const struct sock *sk, const struct sk_buff *skb, > } > > ppiov = skb_frag_page_pool_iov(frag); > + > + /* Disallow non devmem owned buffers */ > + if (ppiov->pp->p.memory_provider != PP_MP_DMABUF_DEVMEM) { > + err = -ENODEV; > + goto out; > + } > + Instead of this, I maybe recommend modifying the skb->dmabuf flag? My mental model is that flag means all the frags in the skb are specifically dmabuf, not general ppiovs or net_iovs. Is it possible to add skb->io_uring or something? If that bloats the skb headers, then maybe we need another place to put this flag. Maybe the [page_pool|net]_iov should declare whether it's dmabuf or otherwise, and we can check frag[0] and assume all frags are the same as frag0. But IMO the page pool internals should not leak into the implementation of generic tcp stack functions. > end = start + skb_frag_size(frag); > copy = end - offset; > > -- > 2.39.3 > -- Thanks, Mina
Powered by blists - more mailing lists