netdev - Re: [PATCH ipsec-rc] xfrm: delete intermediate secpath entry in packet offload mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Z30URE1xbTYPv1Ro@gauss3.secunet.de>
Date: Tue, 7 Jan 2025 12:47:16 +0100
From: Steffen Klassert <steffen.klassert@...unet.com>
To: Leon Romanovsky <leon@...nel.org>
CC: Alexandre Cassen <acassen@...p.free.fr>, "David S. Miller"
	<davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, Herbert Xu
	<herbert@...dor.apana.org.au>, Jakub Kicinski <kuba@...nel.org>,
	<netdev@...r.kernel.org>, Paolo Abeni <pabeni@...hat.com>, Raed Salem
	<raeds@...dia.com>
Subject: Re: [PATCH ipsec-rc] xfrm: delete intermediate secpath entry in
 packet offload mode

On Thu, Jan 02, 2025 at 12:11:11PM +0200, Leon Romanovsky wrote:
> From: Alexandre Cassen <acassen@...p.free.fr>
> 
> Packets handled by hardware have added secpath as a way to inform XFRM
> core code that this path was already handled. That secpath is not needed
> at all after policy is checked and it is removed later in the stack.
> 
> However, in the case of IP forwarding is enabled (/proc/sys/net/ipv4/ip_forward),
> that secpath is not removed and packets which already were handled are reentered
> to the driver TX path with xfrm_offload set.
> 
> The following kernel panic is observed in mlx5 in such case:
> 
>  mlx5_core 0000:04:00.0 enp4s0f0np0: Link up
>  mlx5_core 0000:04:00.1 enp4s0f1np1: Link up
>  Initializing XFRM netlink socket
>  IPsec XFRM device driver
>  BUG: kernel NULL pointer dereference, address: 0000000000000000
>  #PF: supervisor instruction fetch in kernel mode
>  #PF: error_code(0x0010) - not-present page
>  PGD 0 P4D 0
>  Oops: Oops: 0010 [#1] PREEMPT SMP
>  CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.13.0-rc1-alex #3
>  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1.1 04/01/2014
>  RIP: 0010:0x0
>  Code: Unable to access opcode bytes at 0xffffffffffffffd6.
>  RSP: 0018:ffffb87380003800 EFLAGS: 00010206
>  RAX: ffff8df004e02600 RBX: ffffb873800038d8 RCX: 00000000ffff98cf
>  RDX: ffff8df00733e108 RSI: ffff8df00521fb80 RDI: ffff8df001661f00
>  RBP: ffffb87380003850 R08: ffff8df013980000 R09: 0000000000000010
>  R10: 0000000000000002 R11: 0000000000000002 R12: ffff8df001661f00
>  R13: ffff8df00521fb80 R14: ffff8df00733e108 R15: ffff8df011faf04e
>  FS:  0000000000000000(0000) GS:ffff8df46b800000(0000) knlGS:0000000000000000
>  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>  CR2: ffffffffffffffd6 CR3: 0000000106384000 CR4: 0000000000350ef0
>  Call Trace:

...

> 
> Fixes: 5958372ddf62 ("xfrm: add RX datapath protection for IPsec packet offload mode")
> Signed-off-by: Alexandre Cassen <acassen@...p.free.fr>
> Signed-off-by: Leon Romanovsky <leonro@...dia.com>

Applied, thanks a lot!