* [PATCH net] tun: Fix use-after-free on XDP_TX
@ 2018-07-13 4:24 Toshiaki Makita
2018-07-13 5:05 ` Jason Wang
2018-07-16 20:39 ` David Miller
0 siblings, 2 replies; 4+ messages in thread
From: Toshiaki Makita @ 2018-07-13 4:24 UTC (permalink / raw)
To: David S . Miller; +Cc: Toshiaki Makita, netdev, Jesper Dangaard Brouer
On XDP_TX we need to free up the frame only when tun_xdp_tx() returns a
negative value. A positive value indicates that the packet is
successfully enqueued to the ptr_ring, so freeing the page causes
use-after-free.
Fixes: 735fc4054b3a ("xdp: change ndo_xdp_xmit API to support bulking")
Signed-off-by: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
---
drivers/net/tun.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index a192a01..f5727ba 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1688,7 +1688,7 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun,
case XDP_TX:
get_page(alloc_frag->page);
alloc_frag->offset += buflen;
- if (tun_xdp_tx(tun->dev, &xdp))
+ if (tun_xdp_tx(tun->dev, &xdp) < 0)
goto err_redirect;
rcu_read_unlock();
local_bh_enable();
--
1.8.3.1
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH net] tun: Fix use-after-free on XDP_TX
2018-07-13 4:24 [PATCH net] tun: Fix use-after-free on XDP_TX Toshiaki Makita
@ 2018-07-13 5:05 ` Jason Wang
2018-07-13 5:57 ` Jesper Dangaard Brouer
2018-07-16 20:39 ` David Miller
1 sibling, 1 reply; 4+ messages in thread
From: Jason Wang @ 2018-07-13 5:05 UTC (permalink / raw)
To: Toshiaki Makita, David S . Miller; +Cc: netdev, Jesper Dangaard Brouer
On 2018年07月13日 12:24, Toshiaki Makita wrote:
> On XDP_TX we need to free up the frame only when tun_xdp_tx() returns a
> negative value. A positive value indicates that the packet is
> successfully enqueued to the ptr_ring, so freeing the page causes
> use-after-free.
>
> Fixes: 735fc4054b3a ("xdp: change ndo_xdp_xmit API to support bulking")
> Signed-off-by: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
> ---
> drivers/net/tun.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/tun.c b/drivers/net/tun.c
> index a192a01..f5727ba 100644
> --- a/drivers/net/tun.c
> +++ b/drivers/net/tun.c
> @@ -1688,7 +1688,7 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun,
> case XDP_TX:
> get_page(alloc_frag->page);
> alloc_frag->offset += buflen;
> - if (tun_xdp_tx(tun->dev, &xdp))
> + if (tun_xdp_tx(tun->dev, &xdp) < 0)
> goto err_redirect;
> rcu_read_unlock();
> local_bh_enable();
Acked-by: Jason Wang <jasowang@redhat.com>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH net] tun: Fix use-after-free on XDP_TX
2018-07-13 5:05 ` Jason Wang
@ 2018-07-13 5:57 ` Jesper Dangaard Brouer
0 siblings, 0 replies; 4+ messages in thread
From: Jesper Dangaard Brouer @ 2018-07-13 5:57 UTC (permalink / raw)
To: Jason Wang; +Cc: Toshiaki Makita, David S . Miller, netdev, brouer
On Fri, 13 Jul 2018 13:05:04 +0800
Jason Wang <jasowang@redhat.com> wrote:
> On 2018年07月13日 12:24, Toshiaki Makita wrote:
> > On XDP_TX we need to free up the frame only when tun_xdp_tx() returns a
> > negative value. A positive value indicates that the packet is
> > successfully enqueued to the ptr_ring, so freeing the page causes
> > use-after-free.
> >
> > Fixes: 735fc4054b3a ("xdp: change ndo_xdp_xmit API to support bulking")
> > Signed-off-by: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
> > ---
> > drivers/net/tun.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/net/tun.c b/drivers/net/tun.c
> > index a192a01..f5727ba 100644
> > --- a/drivers/net/tun.c
> > +++ b/drivers/net/tun.c
> > @@ -1688,7 +1688,7 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun,
> > case XDP_TX:
> > get_page(alloc_frag->page);
> > alloc_frag->offset += buflen;
> > - if (tun_xdp_tx(tun->dev, &xdp))
> > + if (tun_xdp_tx(tun->dev, &xdp) < 0)
> > goto err_redirect;
> > rcu_read_unlock();
> > local_bh_enable();
>
> Acked-by: Jason Wang <jasowang@redhat.com>
Acked-by: Jesper Dangaard Brouer <brouer@redhat.com>
Thanks for catching and fixing this!
--
Best regards,
Jesper Dangaard Brouer
MSc.CS, Principal Kernel Engineer at Red Hat
LinkedIn: http://www.linkedin.com/in/brouer
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH net] tun: Fix use-after-free on XDP_TX
2018-07-13 4:24 [PATCH net] tun: Fix use-after-free on XDP_TX Toshiaki Makita
2018-07-13 5:05 ` Jason Wang
@ 2018-07-16 20:39 ` David Miller
1 sibling, 0 replies; 4+ messages in thread
From: David Miller @ 2018-07-16 20:39 UTC (permalink / raw)
To: makita.toshiaki; +Cc: netdev, brouer
From: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
Date: Fri, 13 Jul 2018 13:24:38 +0900
> On XDP_TX we need to free up the frame only when tun_xdp_tx() returns a
> negative value. A positive value indicates that the packet is
> successfully enqueued to the ptr_ring, so freeing the page causes
> use-after-free.
>
> Fixes: 735fc4054b3a ("xdp: change ndo_xdp_xmit API to support bulking")
> Signed-off-by: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
Applied, thank you.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2018-07-16 21:08 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-07-13 4:24 [PATCH net] tun: Fix use-after-free on XDP_TX Toshiaki Makita
2018-07-13 5:05 ` Jason Wang
2018-07-13 5:57 ` Jesper Dangaard Brouer
2018-07-16 20:39 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).