* [PATCH net 0/2] XDP fixes for socionext driver
@ 2020-01-25 11:48 Lorenzo Bianconi
2020-01-25 11:48 ` [PATCH net 1/2] net: socionext: fix possible user-after-free in netsec_process_rx Lorenzo Bianconi
` (2 more replies)
0 siblings, 3 replies; 8+ messages in thread
From: Lorenzo Bianconi @ 2020-01-25 11:48 UTC (permalink / raw)
To: netdev; +Cc: ilias.apalodimas, davem, lorenzo.bianconi, brouer
Fix possible user-after-in XDP rx path
Fix rx statistics accounting if no bpf program is attached
Lorenzo Bianconi (2):
net: socionext: fix possible user-after-free in netsec_process_rx
net: socionext: fix xdp_result initialization in netsec_process_rx
drivers/net/ethernet/socionext/netsec.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--
2.21.1
^ permalink raw reply [flat|nested] 8+ messages in thread* [PATCH net 1/2] net: socionext: fix possible user-after-free in netsec_process_rx
2020-01-25 11:48 [PATCH net 0/2] XDP fixes for socionext driver Lorenzo Bianconi
@ 2020-01-25 11:48 ` Lorenzo Bianconi
2020-01-25 12:45 ` Jesper Dangaard Brouer
2020-01-27 8:01 ` Ilias Apalodimas
2020-01-25 11:48 ` [PATCH net 2/2] net: socionext: fix xdp_result initialization " Lorenzo Bianconi
2020-01-27 10:08 ` [PATCH net 0/2] XDP fixes for socionext driver David Miller
2 siblings, 2 replies; 8+ messages in thread
From: Lorenzo Bianconi @ 2020-01-25 11:48 UTC (permalink / raw)
To: netdev; +Cc: ilias.apalodimas, davem, lorenzo.bianconi, brouer
Fix possible use-after-free in in netsec_process_rx that can occurs if
the first packet is sent to the normal networking stack and the
following one is dropped by the bpf program attached to the xdp hook.
Fix the issue defining the skb pointer in the 'budget' loop
Fixes: ba2b232108d3c ("net: netsec: add XDP support")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
---
drivers/net/ethernet/socionext/netsec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/socionext/netsec.c b/drivers/net/ethernet/socionext/netsec.c
index 869a498e3b5e..0e12a9856aea 100644
--- a/drivers/net/ethernet/socionext/netsec.c
+++ b/drivers/net/ethernet/socionext/netsec.c
@@ -929,7 +929,6 @@ static int netsec_process_rx(struct netsec_priv *priv, int budget)
struct netsec_rx_pkt_info rx_info;
enum dma_data_direction dma_dir;
struct bpf_prog *xdp_prog;
- struct sk_buff *skb = NULL;
u16 xdp_xmit = 0;
u32 xdp_act = 0;
int done = 0;
@@ -943,6 +942,7 @@ static int netsec_process_rx(struct netsec_priv *priv, int budget)
struct netsec_de *de = dring->vaddr + (DESC_SZ * idx);
struct netsec_desc *desc = &dring->desc[idx];
struct page *page = virt_to_page(desc->addr);
+ struct sk_buff *skb = NULL;
u32 xdp_result = XDP_PASS;
u16 pkt_len, desc_len;
dma_addr_t dma_handle;
--
2.21.1
^ permalink raw reply related [flat|nested] 8+ messages in thread* Re: [PATCH net 1/2] net: socionext: fix possible user-after-free in netsec_process_rx
2020-01-25 11:48 ` [PATCH net 1/2] net: socionext: fix possible user-after-free in netsec_process_rx Lorenzo Bianconi
@ 2020-01-25 12:45 ` Jesper Dangaard Brouer
2020-01-27 8:01 ` Ilias Apalodimas
1 sibling, 0 replies; 8+ messages in thread
From: Jesper Dangaard Brouer @ 2020-01-25 12:45 UTC (permalink / raw)
To: Lorenzo Bianconi
Cc: netdev, ilias.apalodimas, davem, lorenzo.bianconi, brouer
On Sat, 25 Jan 2020 12:48:50 +0100
Lorenzo Bianconi <lorenzo@kernel.org> wrote:
> Fix possible use-after-free in in netsec_process_rx that can occurs if
> the first packet is sent to the normal networking stack and the
> following one is dropped by the bpf program attached to the xdp hook.
> Fix the issue defining the skb pointer in the 'budget' loop
>
> Fixes: ba2b232108d3c ("net: netsec: add XDP support")
> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
> ---
Acked-by: Jesper Dangaard Brouer <brouer@redhat.com>
> drivers/net/ethernet/socionext/netsec.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/ethernet/socionext/netsec.c b/drivers/net/ethernet/socionext/netsec.c
> index 869a498e3b5e..0e12a9856aea 100644
> --- a/drivers/net/ethernet/socionext/netsec.c
> +++ b/drivers/net/ethernet/socionext/netsec.c
> @@ -929,7 +929,6 @@ static int netsec_process_rx(struct netsec_priv *priv, int budget)
> struct netsec_rx_pkt_info rx_info;
> enum dma_data_direction dma_dir;
> struct bpf_prog *xdp_prog;
> - struct sk_buff *skb = NULL;
> u16 xdp_xmit = 0;
> u32 xdp_act = 0;
> int done = 0;
> @@ -943,6 +942,7 @@ static int netsec_process_rx(struct netsec_priv *priv, int budget)
> struct netsec_de *de = dring->vaddr + (DESC_SZ * idx);
> struct netsec_desc *desc = &dring->desc[idx];
> struct page *page = virt_to_page(desc->addr);
> + struct sk_buff *skb = NULL;
> u32 xdp_result = XDP_PASS;
> u16 pkt_len, desc_len;
> dma_addr_t dma_handle;
Yes, this is needed in case an xdp_prog jumps to label 'next:',
skipping the skb = build_skb() assignment.
--
Best regards,
Jesper Dangaard Brouer
MSc.CS, Principal Kernel Engineer at Red Hat
LinkedIn: http://www.linkedin.com/in/brouer
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [PATCH net 1/2] net: socionext: fix possible user-after-free in netsec_process_rx
2020-01-25 11:48 ` [PATCH net 1/2] net: socionext: fix possible user-after-free in netsec_process_rx Lorenzo Bianconi
2020-01-25 12:45 ` Jesper Dangaard Brouer
@ 2020-01-27 8:01 ` Ilias Apalodimas
1 sibling, 0 replies; 8+ messages in thread
From: Ilias Apalodimas @ 2020-01-27 8:01 UTC (permalink / raw)
To: Lorenzo Bianconi; +Cc: netdev, davem, lorenzo.bianconi, brouer
On Sat, Jan 25, 2020 at 12:48:50PM +0100, Lorenzo Bianconi wrote:
> Fix possible use-after-free in in netsec_process_rx that can occurs if
> the first packet is sent to the normal networking stack and the
> following one is dropped by the bpf program attached to the xdp hook.
> Fix the issue defining the skb pointer in the 'budget' loop
>
> Fixes: ba2b232108d3c ("net: netsec: add XDP support")
> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
> ---
> drivers/net/ethernet/socionext/netsec.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/ethernet/socionext/netsec.c b/drivers/net/ethernet/socionext/netsec.c
> index 869a498e3b5e..0e12a9856aea 100644
> --- a/drivers/net/ethernet/socionext/netsec.c
> +++ b/drivers/net/ethernet/socionext/netsec.c
> @@ -929,7 +929,6 @@ static int netsec_process_rx(struct netsec_priv *priv, int budget)
> struct netsec_rx_pkt_info rx_info;
> enum dma_data_direction dma_dir;
> struct bpf_prog *xdp_prog;
> - struct sk_buff *skb = NULL;
> u16 xdp_xmit = 0;
> u32 xdp_act = 0;
> int done = 0;
> @@ -943,6 +942,7 @@ static int netsec_process_rx(struct netsec_priv *priv, int budget)
> struct netsec_de *de = dring->vaddr + (DESC_SZ * idx);
> struct netsec_desc *desc = &dring->desc[idx];
> struct page *page = virt_to_page(desc->addr);
> + struct sk_buff *skb = NULL;
> u32 xdp_result = XDP_PASS;
> u16 pkt_len, desc_len;
> dma_addr_t dma_handle;
> --
> 2.21.1
>
Acked-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
^ permalink raw reply [flat|nested] 8+ messages in thread
* [PATCH net 2/2] net: socionext: fix xdp_result initialization in netsec_process_rx
2020-01-25 11:48 [PATCH net 0/2] XDP fixes for socionext driver Lorenzo Bianconi
2020-01-25 11:48 ` [PATCH net 1/2] net: socionext: fix possible user-after-free in netsec_process_rx Lorenzo Bianconi
@ 2020-01-25 11:48 ` Lorenzo Bianconi
2020-01-25 12:50 ` Jesper Dangaard Brouer
2020-01-27 8:01 ` Ilias Apalodimas
2020-01-27 10:08 ` [PATCH net 0/2] XDP fixes for socionext driver David Miller
2 siblings, 2 replies; 8+ messages in thread
From: Lorenzo Bianconi @ 2020-01-25 11:48 UTC (permalink / raw)
To: netdev; +Cc: ilias.apalodimas, davem, lorenzo.bianconi, brouer
Fix xdp_result initialization in netsec_process_rx in order to not
increase rx counters if there is no bpf program attached to the xdp hook
and napi_gro_receive returns GRO_DROP
Fixes: ba2b232108d3c ("net: netsec: add XDP support")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
---
drivers/net/ethernet/socionext/netsec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/socionext/netsec.c b/drivers/net/ethernet/socionext/netsec.c
index 0e12a9856aea..56c0e643f430 100644
--- a/drivers/net/ethernet/socionext/netsec.c
+++ b/drivers/net/ethernet/socionext/netsec.c
@@ -942,8 +942,8 @@ static int netsec_process_rx(struct netsec_priv *priv, int budget)
struct netsec_de *de = dring->vaddr + (DESC_SZ * idx);
struct netsec_desc *desc = &dring->desc[idx];
struct page *page = virt_to_page(desc->addr);
+ u32 xdp_result = NETSEC_XDP_PASS;
struct sk_buff *skb = NULL;
- u32 xdp_result = XDP_PASS;
u16 pkt_len, desc_len;
dma_addr_t dma_handle;
struct xdp_buff xdp;
--
2.21.1
^ permalink raw reply related [flat|nested] 8+ messages in thread* Re: [PATCH net 2/2] net: socionext: fix xdp_result initialization in netsec_process_rx
2020-01-25 11:48 ` [PATCH net 2/2] net: socionext: fix xdp_result initialization " Lorenzo Bianconi
@ 2020-01-25 12:50 ` Jesper Dangaard Brouer
2020-01-27 8:01 ` Ilias Apalodimas
1 sibling, 0 replies; 8+ messages in thread
From: Jesper Dangaard Brouer @ 2020-01-25 12:50 UTC (permalink / raw)
To: Lorenzo Bianconi
Cc: netdev, ilias.apalodimas, davem, lorenzo.bianconi, brouer
On Sat, 25 Jan 2020 12:48:51 +0100
Lorenzo Bianconi <lorenzo@kernel.org> wrote:
> Fix xdp_result initialization in netsec_process_rx in order to not
> increase rx counters if there is no bpf program attached to the xdp hook
> and napi_gro_receive returns GRO_DROP
>
> Fixes: ba2b232108d3c ("net: netsec: add XDP support")
> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
> ---
Acked-by: Jesper Dangaard Brouer <brouer@redhat.com>
> drivers/net/ethernet/socionext/netsec.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/ethernet/socionext/netsec.c b/drivers/net/ethernet/socionext/netsec.c
> index 0e12a9856aea..56c0e643f430 100644
> --- a/drivers/net/ethernet/socionext/netsec.c
> +++ b/drivers/net/ethernet/socionext/netsec.c
> @@ -942,8 +942,8 @@ static int netsec_process_rx(struct netsec_priv *priv, int budget)
> struct netsec_de *de = dring->vaddr + (DESC_SZ * idx);
> struct netsec_desc *desc = &dring->desc[idx];
> struct page *page = virt_to_page(desc->addr);
> + u32 xdp_result = NETSEC_XDP_PASS;
As a help to reviewers value is:
#define NETSEC_XDP_PASS 0
> struct sk_buff *skb = NULL;
> - u32 xdp_result = XDP_PASS;
XDP_PASS == 2
> u16 pkt_len, desc_len;
> dma_addr_t dma_handle;
> struct xdp_buff xdp;
--
Best regards,
Jesper Dangaard Brouer
MSc.CS, Principal Kernel Engineer at Red Hat
LinkedIn: http://www.linkedin.com/in/brouer
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [PATCH net 2/2] net: socionext: fix xdp_result initialization in netsec_process_rx
2020-01-25 11:48 ` [PATCH net 2/2] net: socionext: fix xdp_result initialization " Lorenzo Bianconi
2020-01-25 12:50 ` Jesper Dangaard Brouer
@ 2020-01-27 8:01 ` Ilias Apalodimas
1 sibling, 0 replies; 8+ messages in thread
From: Ilias Apalodimas @ 2020-01-27 8:01 UTC (permalink / raw)
To: Lorenzo Bianconi; +Cc: netdev, davem, lorenzo.bianconi, brouer
On Sat, Jan 25, 2020 at 12:48:51PM +0100, Lorenzo Bianconi wrote:
> Fix xdp_result initialization in netsec_process_rx in order to not
> increase rx counters if there is no bpf program attached to the xdp hook
> and napi_gro_receive returns GRO_DROP
>
> Fixes: ba2b232108d3c ("net: netsec: add XDP support")
> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
> ---
> drivers/net/ethernet/socionext/netsec.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/ethernet/socionext/netsec.c b/drivers/net/ethernet/socionext/netsec.c
> index 0e12a9856aea..56c0e643f430 100644
> --- a/drivers/net/ethernet/socionext/netsec.c
> +++ b/drivers/net/ethernet/socionext/netsec.c
> @@ -942,8 +942,8 @@ static int netsec_process_rx(struct netsec_priv *priv, int budget)
> struct netsec_de *de = dring->vaddr + (DESC_SZ * idx);
> struct netsec_desc *desc = &dring->desc[idx];
> struct page *page = virt_to_page(desc->addr);
> + u32 xdp_result = NETSEC_XDP_PASS;
> struct sk_buff *skb = NULL;
> - u32 xdp_result = XDP_PASS;
> u16 pkt_len, desc_len;
> dma_addr_t dma_handle;
> struct xdp_buff xdp;
> --
> 2.21.1
>
Acked-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH net 0/2] XDP fixes for socionext driver
2020-01-25 11:48 [PATCH net 0/2] XDP fixes for socionext driver Lorenzo Bianconi
2020-01-25 11:48 ` [PATCH net 1/2] net: socionext: fix possible user-after-free in netsec_process_rx Lorenzo Bianconi
2020-01-25 11:48 ` [PATCH net 2/2] net: socionext: fix xdp_result initialization " Lorenzo Bianconi
@ 2020-01-27 10:08 ` David Miller
2 siblings, 0 replies; 8+ messages in thread
From: David Miller @ 2020-01-27 10:08 UTC (permalink / raw)
To: lorenzo; +Cc: netdev, ilias.apalodimas, lorenzo.bianconi, brouer
From: Lorenzo Bianconi <lorenzo@kernel.org>
Date: Sat, 25 Jan 2020 12:48:49 +0100
> Fix possible user-after-in XDP rx path
> Fix rx statistics accounting if no bpf program is attached
Series applied and queued up for -stable, thank you.
^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2020-01-27 10:08 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-01-25 11:48 [PATCH net 0/2] XDP fixes for socionext driver Lorenzo Bianconi
2020-01-25 11:48 ` [PATCH net 1/2] net: socionext: fix possible user-after-free in netsec_process_rx Lorenzo Bianconi
2020-01-25 12:45 ` Jesper Dangaard Brouer
2020-01-27 8:01 ` Ilias Apalodimas
2020-01-25 11:48 ` [PATCH net 2/2] net: socionext: fix xdp_result initialization " Lorenzo Bianconi
2020-01-25 12:50 ` Jesper Dangaard Brouer
2020-01-27 8:01 ` Ilias Apalodimas
2020-01-27 10:08 ` [PATCH net 0/2] XDP fixes for socionext driver David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).