netdev - xdp/xsk.c: Possible bug in xdp_umem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <2d6ff64a-5e2c-4078-a8d1-84f1ff3361ce@arctic-alpaca.de>
Date: Sun, 7 Jul 2024 17:05:42 +0200
From: Julian Schindel <mail@...tic-alpaca.de>
To: bpf@...r.kernel.org
Cc: Björn Töpel <bjorn@...nel.org>,
 Magnus Karlsson <magnus.karlsson@...el.com>,
 Maciej Fijalkowski <maciej.fijalkowski@...el.com>,
 Stanislav Fomichev <sdf@...gle.com>, netdev@...r.kernel.org
Subject: xdp/xsk.c: Possible bug in xdp_umem_reg version check

Hi,

I hope this is the correct way to ask about this issue, I haven't used
the kernel mailing list before.

Between different compilations of an AF_XDP project, I encountered
"random" EINVAL errors when calling setsockopt XDP_UMEM_REG with the
same parameter.

I think this might be caused by this patch:
https://lore.kernel.org/all/20231127190319.1190813-2-sdf@google.com/
It added "tx_metadata_len" to the "xdp_umem_reg" struct.
In the  "xsk_setsockopt" code in xdp/xsk.c, the provided "optlen" is
checked against the length of "xdp_umem_reg_v2" and "xdp_umem_reg" to
check which version of "xdp_umem_reg", the user supplied.

At least on my machine (x86_64, Fedora 40, 6.9.7), these two structs
have the same size (32 bytes) due to the compiler adding padding to
"xdp_umem_reg_v2". This means if the user supplies "xdp_umem_reg_v2", it
is falsely treated as "xdp_umem_reg".

I'm not sure whether there is some implicit struct packing happening or
whether this is indeed a bug.

Best regards,
Julian