netdev - Re: [PATCH net] xsk: avoid data corruption on cq descriptor number

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <a0b39fda-4aca-44e3-a178-4bad431243c5@suse.de>
Date: Wed, 22 Oct 2025 20:24:58 +0200
From: Fernando Fernandez Mancera <fmancera@...e.de>
To: netdev@...r.kernel.org
Cc: csmate@....hu, kerneljasonxing@...il.com, maciej.fijalkowski@...el.com,
 bjorn@...nel.org, sdf@...ichev.me, jonathan.lemon@...il.com,
 bpf@...r.kernel.org
Subject: Re: [PATCH net] xsk: avoid data corruption on cq descriptor number



On 10/21/25 5:06 PM, Fernando Fernandez Mancera wrote:
> Since commit 30f241fcf52a ("xsk: Fix immature cq descriptor
> production"), the descriptor number is store in skb control block and
> xsk_cq_submit_addr_locked() relies on it to put the umem addrs onto
> pool's completion queue.
> 
> skb control block shouldn't be used for this purpose as after transmit
> xsk doesn't have control over it and other subsystems could use it. This
> leads to the following kernel panic due to a NULL pointer dereference.
> 
>   BUG: kernel NULL pointer dereference, address: 0000000000000000
>   #PF: supervisor read access in kernel mode
>   #PF: error_code(0x0000) - not-present page
>   PGD 0 P4D 0
>   Oops: Oops: 0000 [#1] SMP NOPTI
>   CPU: 2 UID: 1 PID: 927 Comm: p4xsk.bin Not tainted 6.16.12+deb14-cloud-amd64 #1 PREEMPT(lazy)  Debian 6.16.12-1
>   Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014
>   RIP: 0010:xsk_destruct_skb+0xd0/0x180
>   [...]
>   Call Trace:
>    <IRQ>
>    ? napi_complete_done+0x7a/0x1a0
>    ip_rcv_core+0x1bb/0x340
>    ip_rcv+0x30/0x1f0
>    __netif_receive_skb_one_core+0x85/0xa0
>    process_backlog+0x87/0x130
>    __napi_poll+0x28/0x180
>    net_rx_action+0x339/0x420
>    handle_softirqs+0xdc/0x320
>    ? handle_edge_irq+0x90/0x1e0
>    do_softirq.part.0+0x3b/0x60
>    </IRQ>
>    <TASK>
>    __local_bh_enable_ip+0x60/0x70
>    __dev_direct_xmit+0x14e/0x1f0
>    __xsk_generic_xmit+0x482/0xb70
>    ? __remove_hrtimer+0x41/0xa0
>    ? __xsk_generic_xmit+0x51/0xb70
>    ? _raw_spin_unlock_irqrestore+0xe/0x40
>    xsk_sendmsg+0xda/0x1c0
>    __sys_sendto+0x1ee/0x200
>    __x64_sys_sendto+0x24/0x30
>    do_syscall_64+0x84/0x2f0
>    ? __pfx_pollwake+0x10/0x10
>    ? __rseq_handle_notify_resume+0xad/0x4c0
>    ? restore_fpregs_from_fpstate+0x3c/0x90
>    ? switch_fpu_return+0x5b/0xe0
>    ? do_syscall_64+0x204/0x2f0
>    ? do_syscall_64+0x204/0x2f0
>    ? do_syscall_64+0x204/0x2f0
>    entry_SYSCALL_64_after_hwframe+0x76/0x7e
>    </TASK>
>   [...]
>   Kernel panic - not syncing: Fatal exception in interrupt
>   Kernel Offset: 0x1c000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
> 
> The approach proposed store the first address also in the xsk_addr_node
> along with the number of descriptors. The head xsk_addr_node is
> referenced by skb_shinfo(skb)->destructor_arg. The rest of the fragments
> store the address on the list.
> 
> This is less efficient as the kmem_cache must be initialized even if a
> single fragment is received and also 4 bytes are wasted when storing
> each address.
> 
> Fixes: 30f241fcf52a ("xsk: Fix immature cq descriptor production")
> Closes: https://lore.kernel.org/netdev/0435b904-f44f-48f8-afb0-68868474bf1c@nop.hu/
> Signed-off-by: Fernando Fernandez Mancera <fmancera@...e.de>
> ---
> Note: Please notice I am not an XDP expert so I cannot tell if this
> would cause a performance regression, advice is welcomed.
> ---
>   net/xdp/xsk.c | 57 ++++++++++++++++++++++++++++++---------------------
>   1 file changed, 34 insertions(+), 23 deletions(-)
> 
> diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
> index 7b0c68a70888..203934aeade6 100644
> --- a/net/xdp/xsk.c
> +++ b/net/xdp/xsk.c
> @@ -37,18 +37,14 @@
>   #define MAX_PER_SOCKET_BUDGET 32
>   
>   struct xsk_addr_node {
> +	u32 num_descs;
>   	u64 addr;
>   	struct list_head addr_node;
>   };
>   
> -struct xsk_addr_head {
> -	u32 num_descs;
> -	struct list_head addrs_list;
> -};
> -
>   static struct kmem_cache *xsk_tx_generic_cache;
>   

FWIW, if the 4 bytes wasted for each umem address other than the initial 
one is too much, we can add another kmem_cache for just the xsk_addr_head..