netdev - Re: [PATCH net 1/2] net: xdp: Disallow attaching device-bound programs in generic mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <17742abb-d85f-4102-be86-2b0be922f44c@iogearbox.net>
Date: Mon, 27 Jan 2025 16:55:58 +0100
From: Daniel Borkmann <daniel@...earbox.net>
To: Toke Høiland-Jørgensen <toke@...hat.com>,
 Alexei Starovoitov <ast@...nel.org>, "David S. Miller"
 <davem@...emloft.net>, Jakub Kicinski <kuba@...nel.org>,
 Jesper Dangaard Brouer <hawk@...nel.org>,
 John Fastabend <john.fastabend@...il.com>,
 Stanislav Fomichev <sdf@...ichev.me>,
 Martin KaFai Lau <martin.lau@...nel.org>
Cc: Marcus Wichelmann <marcus.wichelmann@...zner-cloud.de>,
 Eric Dumazet <edumazet@...gle.com>, Paolo Abeni <pabeni@...hat.com>,
 Simon Horman <horms@...nel.org>, netdev@...r.kernel.org, bpf@...r.kernel.org
Subject: Re: [PATCH net 1/2] net: xdp: Disallow attaching device-bound
 programs in generic mode

On 1/27/25 2:13 PM, Toke Høiland-Jørgensen wrote:
> Device-bound programs are used to support RX metadata kfuncs. These
> kfuncs are driver-specific and rely on the driver context to read the
> metadata. This means they can't work in generic XDP mode. However, there
> is no check to disallow such programs from being attached in generic
> mode, in which case the metadata kfuncs will be called in an invalid
> context, leading to crashes.
> 
> Fix this by adding a check to disallow attaching device-bound programs
> in generic mode.
> 
> Fixes: 2b3486bc2d23 ("bpf: Introduce device-bound XDP programs")
> Reported-by: Marcus Wichelmann <marcus.wichelmann@...zner-cloud.de>
> Closes: https://lore.kernel.org/r/dae862ec-43b5-41a0-8edf-46c59071cdda@hetzner-cloud.de
> Tested-by: Marcus Wichelmann <marcus.wichelmann@...zner-cloud.de>
> Acked-by: Stanislav Fomichev <sdf@...ichev.me>
> Signed-off-by: Toke Høiland-Jørgensen <toke@...hat.com>

Acked-by: Daniel Borkmann <daniel@...earbox.net>