netdev - Re: [PATCH] sfc: handle NULL returned by xdp_convert_buff_to

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <a13646af-78f7-4ba7-9767-41d598222b1d@kernel.org>
Date: Thu, 31 Jul 2025 11:14:14 +0200
From: Jesper Dangaard Brouer <hawk@...nel.org>
To: Edward Cree <ecree@....com>, Paolo Abeni <pabeni@...hat.com>,
 Chenyuan Yang <chenyuan0y@...il.com>, ecree.xilinx@...il.com,
 andrew+netdev@...n.ch, davem@...emloft.net, edumazet@...gle.com,
 kuba@...nel.org, ast@...nel.org, daniel@...earbox.net,
 john.fastabend@...il.com, sdf@...ichev.me, lorenzo@...nel.org
Cc: netdev@...r.kernel.org, linux-net-drivers@....com, bpf@...r.kernel.org,
 zzjas98@...il.com
Subject: Re: [PATCH] sfc: handle NULL returned by xdp_convert_buff_to_frame()

On 25/07/2025 12.11, Edward Cree wrote:
> On 7/24/25 10:57, Paolo Abeni wrote:
>> On 7/23/25 2:32 AM, Chenyuan Yang wrote:
>>> The xdp_convert_buff_to_frame() function can return NULL when there is
>>> insufficient headroom in the buffer to store the xdp_frame structure
>>> or when the driver didn't reserve enough tailroom for skb_shared_info.
>>
>> AFAIC the sfc driver reserves both enough headroom and tailroom, but
>> this is after ebpf run, which in turn could consume enough headroom to
>> cause a failure, so I think this makes sense.
> 
> Your reasoning seems plausible to me.

Hmm... have you actually tested that XDP/BPF can adjust headroom so much
that xdp_convert_buff_to_frame() function fails?

I really doubt this possible for BPF-progs to violate this.

The XDP BPF-prog can only adjust the headroom via the helpers
bpf_xdp_adjust_head() and bpf_xdp_adjust_meta().  These helpers reserve
room for sizeof(struct xdp_frame).

The tailroom can be adjusted via helper bpf_xdp_adjust_tail() and it
also reserve room for sizeof(struct skb_shared_info) such that BPF-progs
cannot get access to this area. See define for xdp_data_hard_end.

--Jesper