netdev - Re: null pointer dereference in interrupt after receiving an ip packet on veth from xsk from user space

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1c523c77-7eb7-453b-ba15-d4616edc18fb@nop.hu>
Date: Tue, 21 Oct 2025 15:43:09 +0200
From: mc36 <csmate@....hu>
To: Jason Xing <kerneljasonxing@...il.com>
Cc: Fernando Fernandez Mancera <fmancera@...e.de>, alekcejk@...glemail.com,
 Jonathan Lemon <jonathan.lemon@...il.com>,
 Stanislav Fomichev <sdf@...ichev.me>,
 Maciej Fijalkowski <maciej.fijalkowski@...el.com>,
 Magnus Karlsson <magnus.karlsson@...el.com>, Björn Töpel
 <bjorn@...nel.org>, 1118437@...s.debian.org, netdev@...r.kernel.org,
 bpf@...r.kernel.org
Subject: Re: null pointer dereference in interrupt after receiving an ip
 packet on veth from xsk from user space

hi,

On 10/21/25 15:02, Jason Xing wrote:
>> if you're in a need for some more complicated xsk tests, just let me know, freertr
>>
>> have a dataplane and a socat-alike tool with an xsk based packetio for a while....
> 
> Could you provide a link that points to what you just mentioned? I
> believe more tests on veth are necessary.
> 

sure, but be warned, it's a huge rabbit-hole that you're jumping into.... :)

so the homepage is freertr.org, it provides a daily vm builds...

if you grab the qcow2, convert to raw and mount -o offset=1048576

you can update the kernel and initrd, and you need to put the xdp

bpf and elf libs as they're not part of that image... then umount it,

and after the first boot (look at the serial console!), do the following:

conf t
int eth1
  vrf forwarding host
  ipv4 addr 10.0.2.222 255.255.255.0
  exit
ipv4 route host 0.0.0.0 0.0.0.0 10.0.2.2
end
write
test hwext path /rtr/rtr- dataplane p4xsk
reload cold
y

your xdp dataplath is activated, the vm kernel itself will be behind

a veth pair, the dataplane will play with the qemu virtio-pci and the veth,

and there will be an other veth for the dataplane-controlplane communication

full of random non-ip frames, then

ping 10.255.255.1 vrf host

ping 10.0.2.2 vrf host

will test for the fresh kernel and the outside word...

you can exercise the above with a raw socket on the original image if you do "p4raw"

instead of "p4xsk", and as we're on the bpf, it have an in-kernel forwarder called "p4xdp"....:)



the source is at https://github.com/mc36/freeRtr , the misc/native folder

contains the dataplane, and the socat-alike tools.... just ./c.sh to build them...


afterwards you can create topologies with then like

(1.1.1.1/30)ns1-----<veth1>------host-----<veth2>------ns2(1.1.1.2/30)

to cross connect 2 interfaces on the host, just run 2 processes like

xskInt.bin veth1 skb 1234 127.0.0.1 4321 127.0.0.1

pcapInt.bin veth2 4321 127.0.0.1 1234 127.0.0.1

there are other tools with uring, raw socket, mmaped raw socket

and some others that are uninterested in the current topic imho....


have a nice day,

csaba