netdev - Re: [RFC] net: esp: fix bad handling of pages from page

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 6 Mar 2024 13:05:14 +0000
From: Dragos Tatulea <dtatulea@...dia.com>
To: "kuba@...nel.org" <kuba@...nel.org>
CC: "almasrymina@...gle.com" <almasrymina@...gle.com>, "davem@...emloft.net"
	<davem@...emloft.net>, "herbert@...dor.apana.org.au"
	<herbert@...dor.apana.org.au>, Gal Pressman <gal@...dia.com>,
	"dsahern@...nel.org" <dsahern@...nel.org>, "steffen.klassert@...unet.com"
	<steffen.klassert@...unet.com>, "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>, Leon Romanovsky <leonro@...dia.com>,
	"pabeni@...hat.com" <pabeni@...hat.com>, "edumazet@...gle.com"
	<edumazet@...gle.com>, "ian.kumlien@...il.com" <ian.kumlien@...il.com>,
	"Anatoli.Chechelnickiy@...nterpipe.biz"
	<Anatoli.Chechelnickiy@...nterpipe.biz>, "netdev@...r.kernel.org"
	<netdev@...r.kernel.org>
Subject: Re: [RFC] net: esp: fix bad handling of pages from page_pool

On Tue, 2024-03-05 at 19:04 -0800, Jakub Kicinski wrote:
> On Mon, 4 Mar 2024 11:48:52 +0200 Dragos Tatulea wrote:
> > When the skb is reorganized during esp_output (!esp->inline), the pages
> > coming from the original skb fragments are supposed to be released back
> > to the system through put_page. But if the skb fragment pages are
> > originating from a page_pool, calling put_page on them will trigger a
> > page_pool leak which will eventually result in a crash.
> 
> So it just does: skb_shinfo(skb)->nr_frags = 1;
> and assumes that's equivalent to owning a page ref on all the frags?
> 
My understanding is different: it sets nr_frags to 1 because it's swapping out
the old page frag in fragment 0 with the new xfrag page frag and will use this
"new" skb from here. It does take a page reference for the xfrag page frag.

> Fix looks more or less good, we would need a new wrapper to avoid
> build issues without PAGE_POOL, 
> 
Ack. Which component would be best location for this wrapper: page_pool?

> but I wonder if we wouldn't be better
> off changing the other side. Instead of "cutting off" the frags -
> walking them and dealing with various page types. Because Mina and co.
> will step onto this landmine as well.
The page frags are still stored and used in the sg scatterlist. If we release
them at the moment when the skb is "cut off", the pages in the sg will be
invalid. At least that's my understanding.

Thanks,
Dragos