netdev - Re: [PATCH bpf] bpf, test_run: Fix LIVE_FRAME frame update after a page has been recycled

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZyJGG7aWRb0Lvk13@mini-arch>
Date: Wed, 30 Oct 2024 07:43:39 -0700
From: Stanislav Fomichev <stfomichev@...il.com>
To: Toke Høiland-Jørgensen <toke@...hat.com>
Cc: Alexei Starovoitov <ast@...nel.org>,
	Daniel Borkmann <daniel@...earbox.net>,
	Andrii Nakryiko <andrii@...nel.org>,
	Martin KaFai Lau <martin.lau@...ux.dev>,
	Eduard Zingerman <eddyz87@...il.com>, Song Liu <song@...nel.org>,
	Yonghong Song <yonghong.song@...ux.dev>,
	John Fastabend <john.fastabend@...il.com>,
	KP Singh <kpsingh@...nel.org>, Stanislav Fomichev <sdf@...ichev.me>,
	Hao Luo <haoluo@...gle.com>, Jiri Olsa <jolsa@...nel.org>,
	"David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	Simon Horman <horms@...nel.org>,
	Jesper Dangaard Brouer <hawk@...nel.org>,
	Alexander Lobakin <aleksander.lobakin@...el.com>,
	bpf@...r.kernel.org, netdev@...r.kernel.org,
	syzbot+d121e098da06af416d23@...kaller.appspotmail.com
Subject: Re: [PATCH bpf] bpf, test_run: Fix LIVE_FRAME frame update after a
 page has been recycled

On 10/30, Toke Høiland-Jørgensen wrote:
> The test_run code detects whether a page has been modified and
> re-initialises the xdp_frame structure if it has, using
> xdp_update_frame_from_buff(). However, xdp_update_frame_from_buff()
> doesn't touch frame->mem, so that wasn't correctly re-initialised, which
> led to the pages from page_pool not being returned correctly. Syzbot
> noticed this as a memory leak.
> 
> Fix this by also copying the frame->mem structure when re-initialising
> the frame, like we do on initialisation of a new page from page_pool.
> 
> Reported-by: syzbot+d121e098da06af416d23@...kaller.appspotmail.com
> Tested-by: syzbot+d121e098da06af416d23@...kaller.appspotmail.com
> Fixes: e5995bc7e2ba ("bpf, test_run: fix crashes due to XDP frame overwriting/corruption")
> Fixes: b530e9e1063e ("bpf: Add "live packet" mode for XDP in BPF_PROG_RUN")
> Signed-off-by: Toke Høiland-Jørgensen <toke@...hat.com>

Acked-by: Stanislav Fomichev <sdf@...ichev.me>