netdev - Re: [PATCH net 2/4] ethtool: ntuple: fix rss + ring

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <913c68d5-8695-4dc9-84bf-d2ffe9f8b15a@nvidia.com>
Date: Tue, 4 Feb 2025 08:42:33 +0200
From: Gal Pressman <gal@...dia.com>
To: Joe Damato <jdamato@...tly.com>, Jakub Kicinski <kuba@...nel.org>,
 davem@...emloft.net, netdev@...r.kernel.org, edumazet@...gle.com,
 pabeni@...hat.com, andrew+netdev@...n.ch, horms@...nel.org,
 shuah@...nel.org, ecree.xilinx@...il.com, przemyslaw.kitszel@...el.com
Subject: Re: [PATCH net 2/4] ethtool: ntuple: fix rss + ring_cookie check

On 03/02/2025 23:30, Joe Damato wrote:
> On Mon, Feb 03, 2025 at 01:25:19PM -0800, Jakub Kicinski wrote:
>> On Mon, 3 Feb 2025 13:16:46 -0800 Joe Damato wrote:
>>> On Fri, Jan 31, 2025 at 05:30:38PM -0800, Jakub Kicinski wrote:
>>>> The info.flow_type is for RXFH commands, ntuple flow_type is inside
>>>> the flow spec. The check currently does nothing, as info.flow_type
>>>> is 0 for ETHTOOL_SRXCLSRLINS.  
>>>
>>> Agree with Gal; I think ethtool's stack allocated ethtool_rxnfc
>>> could result in some garbage value being passed in for
>>> info.flow_type.
>>
>> I admit I haven't dug into the user space side, but in the kernel
>> my reading is that the entire struct ethtool_rxnfc, which includes
>> _both_ flow_type fields gets copied in. IOW struct ethtool_rxnfc
>> has two flow_type fields, one directly in the struct and one inside 
>> the fs member.
> 
> Agree with you there; there are two fields and I think your change
> is correct. I think the nit is just the wording of the commit
> message as ethtool's user space stack might have some junk where
> info.flow_type is (instead of 0).

Exactly, zero vs. garbage will determine whether the check does nothing
(as written in the commit message), or have an undefined behavior.