netdev - Re: [PATCH bpf] bpf, test_run: Fix LIVE_FRAME frame update after a page has been recycled

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <0c1f1b72-a70b-4c94-b3f6-c874c9c0a611@intel.com>
Date: Wed, 30 Oct 2024 16:54:50 +0100
From: Alexander Lobakin <aleksander.lobakin@...el.com>
To: Toke Høiland-Jørgensen <toke@...hat.com>
CC: Alexei Starovoitov <ast@...nel.org>, Daniel Borkmann
	<daniel@...earbox.net>, Andrii Nakryiko <andrii@...nel.org>, Martin KaFai Lau
	<martin.lau@...ux.dev>, Eduard Zingerman <eddyz87@...il.com>, Song Liu
	<song@...nel.org>, Yonghong Song <yonghong.song@...ux.dev>, John Fastabend
	<john.fastabend@...il.com>, KP Singh <kpsingh@...nel.org>, Stanislav Fomichev
	<sdf@...ichev.me>, Hao Luo <haoluo@...gle.com>, Jiri Olsa <jolsa@...nel.org>,
	"David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, "Simon
 Horman" <horms@...nel.org>, Jesper Dangaard Brouer <hawk@...nel.org>,
	<bpf@...r.kernel.org>, <netdev@...r.kernel.org>,
	<syzbot+d121e098da06af416d23@...kaller.appspotmail.com>
Subject: Re: [PATCH bpf] bpf, test_run: Fix LIVE_FRAME frame update after a
 page has been recycled

From: Toke Høiland-Jørgensen <toke@...hat.com>
Date: Wed, 30 Oct 2024 11:48:26 +0100

> The test_run code detects whether a page has been modified and
> re-initialises the xdp_frame structure if it has, using
> xdp_update_frame_from_buff(). However, xdp_update_frame_from_buff()
> doesn't touch frame->mem, so that wasn't correctly re-initialised, which
> led to the pages from page_pool not being returned correctly. Syzbot
> noticed this as a memory leak.
> 
> Fix this by also copying the frame->mem structure when re-initialising
> the frame, like we do on initialisation of a new page from page_pool.
> 
> Reported-by: syzbot+d121e098da06af416d23@...kaller.appspotmail.com
> Tested-by: syzbot+d121e098da06af416d23@...kaller.appspotmail.com
> Fixes: e5995bc7e2ba ("bpf, test_run: fix crashes due to XDP frame overwriting/corruption")
> Fixes: b530e9e1063e ("bpf: Add "live packet" mode for XDP in BPF_PROG_RUN")
> Signed-off-by: Toke Høiland-Jørgensen <toke@...hat.com>

Reviewed-by: Alexander Lobakin <aleksander.lobakin@...el.com>

Thanks,
Olek