lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <7fc334b847dc4d90af796f84a8663de9f43ede5d.camel@nvidia.com>
Date: Wed, 6 Mar 2024 13:05:14 +0000
From: Dragos Tatulea <dtatulea@...dia.com>
To: "kuba@...nel.org" <kuba@...nel.org>
CC: "almasrymina@...gle.com" <almasrymina@...gle.com>, "davem@...emloft.net"
	<davem@...emloft.net>, "herbert@...dor.apana.org.au"
	<herbert@...dor.apana.org.au>, Gal Pressman <gal@...dia.com>,
	"dsahern@...nel.org" <dsahern@...nel.org>, "steffen.klassert@...unet.com"
	<steffen.klassert@...unet.com>, "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>, Leon Romanovsky <leonro@...dia.com>,
	"pabeni@...hat.com" <pabeni@...hat.com>, "edumazet@...gle.com"
	<edumazet@...gle.com>, "ian.kumlien@...il.com" <ian.kumlien@...il.com>,
	"Anatoli.Chechelnickiy@...nterpipe.biz"
	<Anatoli.Chechelnickiy@...nterpipe.biz>, "netdev@...r.kernel.org"
	<netdev@...r.kernel.org>
Subject: Re: [RFC] net: esp: fix bad handling of pages from page_pool

On Tue, 2024-03-05 at 19:04 -0800, Jakub Kicinski wrote:
> On Mon, 4 Mar 2024 11:48:52 +0200 Dragos Tatulea wrote:
> > When the skb is reorganized during esp_output (!esp->inline), the pages
> > coming from the original skb fragments are supposed to be released back
> > to the system through put_page. But if the skb fragment pages are
> > originating from a page_pool, calling put_page on them will trigger a
> > page_pool leak which will eventually result in a crash.
> 
> So it just does: skb_shinfo(skb)->nr_frags = 1;
> and assumes that's equivalent to owning a page ref on all the frags?
> 
My understanding is different: it sets nr_frags to 1 because it's swapping out
the old page frag in fragment 0 with the new xfrag page frag and will use this
"new" skb from here. It does take a page reference for the xfrag page frag.

> Fix looks more or less good, we would need a new wrapper to avoid
> build issues without PAGE_POOL, 
> 
Ack. Which component would be best location for this wrapper: page_pool?

> but I wonder if we wouldn't be better
> off changing the other side. Instead of "cutting off" the frags -
> walking them and dealing with various page types. Because Mina and co.
> will step onto this landmine as well.
The page frags are still stored and used in the sg scatterlist. If we release
them at the moment when the skb is "cut off", the pages in the sg will be
invalid. At least that's my understanding.

Thanks,
Dragos

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ