netdev - Re: [PATCH net 2/5] gve: guard XDP xmit NDO on existence of xdp queues

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CALuQH+W3TK4Kvgbf1d+eFjR8W45_84M7T=aD0BeAdbGQdm5koQ@mail.gmail.com>
Date: Thu, 2 Jan 2025 10:43:21 -0800
From: Joshua Washington <joshwash@...gle.com>
To: Alexander Lobakin <aleksander.lobakin@...el.com>
Cc: Praveen Kaligineedi <pkaligineedi@...gle.com>, netdev@...r.kernel.org, 
	Jeroen de Borst <jeroendb@...gle.com>, Shailend Chand <shailend@...gle.com>, 
	Willem de Bruijn <willemb@...gle.com>, andrew+netdev@...n.ch, davem@...emloft.net, 
	Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, 
	ast@...nel.org, daniel@...earbox.net, hawk@...nel.org, 
	john.fastabend@...il.com, horms@...nel.org, 
	Harshitha Ramamurthy <hramamurthy@...gle.com>, Ziwei Xiao <ziweixiao@...gle.com>, 
	open list <linux-kernel@...r.kernel.org>, bpf@...r.kernel.org, stable@...r.kernel.org
Subject: Re: [PATCH net 2/5] gve: guard XDP xmit NDO on existence of xdp queues

> Wouldn't synchronize_rcu() be enough, have you checked?

I based usage of synchronize_net() instead of synchronize_rcu() based on other
drivers deciding to use it due to synchronize_rcu_expedited() when holding
rtnl_lock() being more performant.

ICE: https://lore.kernel.org/all/20240529112337.3639084-4-maciej.fijalkowski@intel.com/
Mellanox: https://lore.kernel.org/netdev/20210212025641.323844-8-saeed@kernel.org/

> You need to use xdp_features_{set,clear}_redirect_target() when you
install/remove XDP prog to notify the kernel that ndo_start_xmit is now
available / not available anymore.

Thank you for the suggestion. Given that the fix has gone in, I was planning
to make this change as part of a future net-next release with other XDP changes.
Would it make sense to make those changes there, given that the patches as
they went up, while not completely correct, should at least cover the
vulnerability?

Thanks,
Josh