netdev - Re: [PATCH net v2] xdp: update mem type when page pool is used for generic XDP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <19df5360-9fee-4ca4-ab66-85aeede3979e@linux.dev>
Date: Thu, 2 Oct 2025 11:32:59 -0700
From: Ihor Solodrai <ihor.solodrai@...ux.dev>
To: Octavian Purdila <tavip@...gle.com>, maciej.fijalkowski@...el.com
Cc: kuba@...nel.org, davem@...emloft.net, edumazet@...gle.com,
 pabeni@...hat.com, horms@...nel.org, ast@...nel.org, daniel@...earbox.net,
 hawk@...nel.org, john.fastabend@...il.com, sdf@...ichev.me,
 kuniyu@...gle.com, aleksander.lobakin@...el.com, toke@...hat.com,
 lorenzo@...nel.org, netdev@...r.kernel.org, bpf@...r.kernel.org,
 syzbot+ff145014d6b0ce64a173@...kaller.appspotmail.com,
 Kernel Team <kernel-team@...a.com>
Subject: Re: [PATCH net v2] xdp: update mem type when page pool is used for
 generic XDP



On 10/1/25 6:02 PM, Octavian Purdila wrote:
> On Wed, Oct 1, 2025 at 1:26 PM Ihor Solodrai <ihor.solodrai@...ux.dev> wrote:
>>
>> Hi Octavian,
>>
> 
> Hi Ihor,
> 
>> This patch seems to be causing a null pointer dereference.
>> See a splat caught by BPF CI below.
>>
>> You might be able to reproduce with:
>>
>> cd tools/testing/selftests/bpf
>> make test_progs
>> # in kernel with this patch
>> ./test_progs -t xdp_veth
>>
>> Reverting this commit mitigates the failure:
>> https://github.com/linux-netdev/testing-bpf-ci/commit/9e1eab63cd1bcbe37e205856f7ff7d1ad49669f5
>>
>> Could you please take a look?
>>
> 
> Thanks for the report, it looks like dev needs to be set in
> xdp_rxq_info. The following fix works me:
> 
> diff --git a/net/core/dev.c b/net/core/dev.c
> index 365c43ffc9c1..85b52c28660b 100644
> --- a/net/core/dev.c
> +++ b/net/core/dev.c
> @@ -5449,7 +5449,9 @@ int do_xdp_generic(const struct bpf_prog
> *xdp_prog, struct sk_buff **pskb)
>         struct bpf_net_context __bpf_net_ctx, *bpf_net_ctx;
> 
>         if (xdp_prog) {
> -               struct xdp_rxq_info rxq = {};
> +               struct xdp_rxq_info rxq = {
> +                       .dev = (*pskb)->dev,
> +               };
>                 struct xdp_buff xdp = {
>                         .rxq = &rxq,
>                 };
> 
> But probably Maciej approach is better.

Hi Octavian, Maciej,

I tested both diffs on BPF CI, no issues.

This patch + diff above assigning .dev:
* Revision: https://github.com/theihor/bpf/commits/refs/heads/netdev-fix-20251002.1/
* CI run: https://github.com/kernel-patches/bpf/actions/runs/18199837294

This patch reverted + Maciej's diff (pasted below):
* Revision: https://github.com/theihor/bpf/commits/refs/heads/netdev-fix-20251002.2/
* CI run: https://github.com/kernel-patches/bpf/actions/runs/18199860590

Tested-by: Ihor Solodrai <ihor.solodrai@...ux.dev>

I am going to add the revert diff as a temporary patch to CI for now.

Thanks!


diff --git a/net/core/dev.c b/net/core/dev.c
index 93a25d87b86b..7707a95ca8ed 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -5269,6 +5269,9 @@ u32 bpf_prog_run_generic_xdp(struct sk_buff *skb, struct xdp_buff *xdp,
 	orig_bcast = is_multicast_ether_addr_64bits(eth->h_dest);
 	orig_eth_type = eth->h_proto;
 
+	xdp->rxq->mem.type = page_pool_page_is_pp(virt_to_page(xdp->data)) ?
+		MEM_TYPE_PAGE_POOL : MEM_TYPE_PAGE_SHARED;
+
 	act = bpf_prog_run_xdp(xdp_prog, xdp);
 
 	/* check if bpf_xdp_adjust_head was used */