netdev - Re: [PATCH net 1/3] eth: bnxt: fix truesize for mb-xdp-pass case

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAOBf=muAGcrAf82e=V9v3vdy_P01de_1oZ-_zK00q9RXwHuC4A@mail.gmail.com>
Date: Wed, 26 Feb 2025 13:50:34 +0530
From: Somnath Kotur <somnath.kotur@...adcom.com>
To: Taehee Yoo <ap420073@...il.com>
Cc: davem@...emloft.net, kuba@...nel.org, pabeni@...hat.com, 
	edumazet@...gle.com, michael.chan@...adcom.com, pavan.chebbi@...adcom.com, 
	andrew+netdev@...n.ch, netdev@...r.kernel.org, gospo@...adcom.com, 
	dw@...idwei.uk, horms@...nel.org
Subject: Re: [PATCH net 1/3] eth: bnxt: fix truesize for mb-xdp-pass case

On Wed, Feb 26, 2025 at 11:48 AM Taehee Yoo <ap420073@...il.com> wrote:
>
> When mb-xdp is set and return is XDP_PASS, packet is converted from
> xdp_buff to sk_buff with xdp_update_skb_shared_info() in
> bnxt_xdp_build_skb().
> bnxt_xdp_build_skb() passes incorrect truesize argument to
> xdp_update_skb_shared_info().
> truesize is calculated as BNXT_RX_PAGE_SIZE * sinfo->nr_frags but
> sinfo->nr_frags should not be used because sinfo->nr_frags is not yet
> updated.
> so it should use num_frags instead.
>
> Splat looks like:
>  ------------[ cut here ]------------
>  WARNING: CPU: 2 PID: 0 at net/core/skbuff.c:6072 skb_try_coalesce+0x504/0x590
>  Modules linked in: xt_nat xt_tcpudp veth af_packet xt_conntrack nft_chain_nat xt_MASQUERADE nf_conntrack_netlink xfrm_user xt_addrtype nft_coms
>  CPU: 2 UID: 0 PID: 0 Comm: swapper/2 Not tainted 6.14.0-rc2+ #3
>  RIP: 0010:skb_try_coalesce+0x504/0x590
>  Code: 4b fd ff ff 49 8b 34 24 40 80 e6 40 0f 84 3d fd ff ff 49 8b 74 24 48 40 f6 c6 01 0f 84 2e fd ff ff 48 8d 4e ff e9 25 fd ff ff <0f> 0b e99
>  RSP: 0018:ffffb62c4120caa8 EFLAGS: 00010287
>  RAX: 0000000000000003 RBX: ffffb62c4120cb14 RCX: 0000000000000ec0
>  RDX: 0000000000001000 RSI: ffffa06e5d7dc000 RDI: 0000000000000003
>  RBP: ffffa06e5d7ddec0 R08: ffffa06e6120a800 R09: ffffa06e7a119900
>  R10: 0000000000002310 R11: ffffa06e5d7dcec0 R12: ffffe4360575f740
>  R13: ffffe43600000000 R14: 0000000000000002 R15: 0000000000000002
>  FS:  0000000000000000(0000) GS:ffffa0755f700000(0000) knlGS:0000000000000000
>  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>  CR2: 00007f147b76b0f8 CR3: 00000001615d4000 CR4: 00000000007506f0
>  PKRU: 55555554
>  Call Trace:
>   <IRQ>
>   ? __warn+0x84/0x130
>   ? skb_try_coalesce+0x504/0x590
>   ? report_bug+0x18a/0x1a0
>   ? handle_bug+0x53/0x90
>   ? exc_invalid_op+0x14/0x70
>   ? asm_exc_invalid_op+0x16/0x20
>   ? skb_try_coalesce+0x504/0x590
>   inet_frag_reasm_finish+0x11f/0x2e0
>   ip_defrag+0x37a/0x900
>   ip_local_deliver+0x51/0x120
>   ip_sublist_rcv_finish+0x64/0x70
>   ip_sublist_rcv+0x179/0x210
>   ip_list_rcv+0xf9/0x130
>
> How to reproduce:
> <Node A>
> ip link set $interface1 xdp obj xdp_pass.o
> ip link set $interface1 mtu 9000 up
> ip a a 10.0.0.1/24 dev $interface1
> <Node B>
> ip link set $interfac2 mtu 9000 up
> ip a a 10.0.0.2/24 dev $interface2
> ping 10.0.0.1 -s 65000
>
> Fixes: 1dc4c557bfed ("bnxt: adding bnxt_xdp_build_skb to build skb from multibuffer xdp_buff")
> Signed-off-by: Taehee Yoo <ap420073@...il.com>
> ---
>  drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c
> index e6c64e4bd66c..e9b49cb5b735 100644
> --- a/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c
> +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c
> @@ -476,7 +476,7 @@ bnxt_xdp_build_skb(struct bnxt *bp, struct sk_buff *skb, u8 num_frags,
>         }
>         xdp_update_skb_shared_info(skb, num_frags,
>                                    sinfo->xdp_frags_size,
> -                                  BNXT_RX_PAGE_SIZE * sinfo->nr_frags,
> +                                  BNXT_RX_PAGE_SIZE * num_frags,
>                                    xdp_buff_is_frag_pfmemalloc(xdp));
>         return skb;
>  }
> --
> 2.34.1
>
Reviewed-by: Somnath Kotur <somnath.kotur@...adcom.com>

Download attachment "smime.p7s" of type "application/pkcs7-signature" (4212 bytes)