netdev - Re: [mlx5_core] kernel NULL pointer dereference when sending packets with AF

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZfUcBnDCepuryS3f@google.com>
Date: Fri, 15 Mar 2024 21:11:50 -0700
From: Stanislav Fomichev <sdf@...gle.com>
To: Daniele Salvatore Albano <d.albano@...il.com>
Cc: netdev@...r.kernel.org
Subject: Re: [mlx5_core] kernel NULL pointer dereference when sending packets
 with AF_XDP using the hw checksum

On 03/16, Daniele Salvatore Albano wrote:
> Hey there,
> 
> Hope this is the right ml, if not sorry in advance.
> 
> I have been facing a reproducible kernel panic with 6.8.0 and 6.8.1
> when sending packets and enabling the HW checksum calculation with
> AF_XDP on my mellanox connect 5.
> 
> Running xskgen ( https://github.com/fomichev/xskgen ), which I saw
> mentioned in some patches related to AF_XDP and the hw checksum
> support. In addition to the minimum parameters to make it work, adding
> the -m option is enough to trigger the kernel panic.

Now I wonder if I ever tested only -m (without passing a flag to request
tx timestamp). Maybe you can try to confirm that `xskgen -mC` works?

If you can test custom patches, I think the following should fix it:

diff --git a/include/net/xdp_sock.h b/include/net/xdp_sock.h
index 3cb4dc9bd70e..3d54de168a6d 100644
--- a/include/net/xdp_sock.h
+++ b/include/net/xdp_sock.h
@@ -188,6 +188,8 @@ static inline void xsk_tx_metadata_complete(struct xsk_tx_metadata_compl *compl,
 {
 	if (!compl)
 		return;
+	if (!compl->tx_timestamp)
+		return;
 
 	*compl->tx_timestamp = ops->tmo_fill_timestamp(priv);
 }

If not, I can try to get my mlx5 setup back in shape sometime next week.