From: Stephen Hemminger <stephen@networkplumber.org>
To: Denis Sergeev <denserg.edu@gmail.com>
Cc: dev@dpdk.org, shepard.siegel@atomicrules.com,
ed.czeck@atomicrules.com, john.miller@atomicrules.com,
stable@dpdk.org, sdl.dpdk@linuxtesting.org
Subject: Re: [PATCH] net/ark: fix unsafe env variable in extension loading
Date: Wed, 3 Jun 2026 08:30:56 -0700 [thread overview]
Message-ID: <20260603083056.26d009f1@phoenix.local> (raw)
In-Reply-To: <20260603052604.118850-1-denserg.edu@gmail.com>
On Wed, 3 Jun 2026 08:26:00 +0300
Denis Sergeev <denserg.edu@gmail.com> wrote:
> diff --git a/drivers/net/ark/ark_ethdev.c b/drivers/net/ark/ark_ethdev.c
> index 8b25ed948f..e25478103b 100644
> --- a/drivers/net/ark/ark_ethdev.c
> +++ b/drivers/net/ark/ark_ethdev.c
> @@ -211,9 +211,19 @@ static int
> check_for_ext(struct ark_adapter *ark)
> {
> int found = 0;
> + const char *dllpath;
> +
> + /*
> + * A basic security check is necessary before trusting
> + * ARK_EXT_PATH environment variable.
> + */
> + if (geteuid() != getuid() || getegid() != getgid()) {
> + ARK_PMD_LOG(DEBUG, "EXT ignoring ARK_EXT_PATH under setuid/setgid\n");
> + return 0;
> + }
>
DPDK may be run in containers. This would break that.
The whole dlopen extension stuff in this driver is rubbish and should not have been allowed in.
It creates testing and security nightmares.
prev parent reply other threads:[~2026-06-03 15:51 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-03 5:26 [PATCH] net/ark: fix unsafe env variable in extension loading Denis Sergeev
2026-06-03 5:32 ` [PATCH v2] " Denis Sergeev
2026-06-03 15:30 ` Stephen Hemminger [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260603083056.26d009f1@phoenix.local \
--to=stephen@networkplumber.org \
--cc=denserg.edu@gmail.com \
--cc=dev@dpdk.org \
--cc=ed.czeck@atomicrules.com \
--cc=john.miller@atomicrules.com \
--cc=sdl.dpdk@linuxtesting.org \
--cc=shepard.siegel@atomicrules.com \
--cc=stable@dpdk.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox