From: Mohamed Khalfella <mkhalfella@purestorage.com>
To: Eric Dumazet <edumazet@google.com>
Cc: willemjdebruijn <willemdebruijn.kernel@gmail.com>,
"David S. Miller" <davem@davemloft.net>,
Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
Willem de Bruijn <willemb@google.com>,
Alexander Duyck <alexanderduyck@fb.com>,
David Howells <dhowells@redhat.com>,
Jesper Dangaard Brouer <brouer@redhat.com>,
Kees Cook <keescook@chromium.org>,
"open list:NETWORKING [GENERAL]" <netdev@vger.kernel.org>,
open list <linux-kernel@vger.kernel.org>,
"open list:BPF [MISC]" <bpf@vger.kernel.org>
Subject: Re: [PATCH] skbuff: skb_segment, Update nfrags after calling zero copy functions
Date: Tue, 29 Aug 2023 02:31:05 -0700 [thread overview]
Message-ID: <20230829093105.GA611013@medusa> (raw)
In-Reply-To: <CANn89iLbNF_kGG9S3R9Y8gpoEM71Wesoi1mTA3-at4Furc+0Fg@mail.gmail.com>
On 2023-08-29 10:07:59 +0200, Eric Dumazet wrote:
> On Tue, Aug 29, 2023 at 8:50 AM Mohamed Khalfella
> <mkhalfella@purestorage.com> wrote:
> >
> > On 2023-08-28 21:18:16 -0700, willemjdebruijn wrote:
> > > Small point: nfrags is not the only state that needs to be refreshed
> > > after a fags realloc, also frag.
> >
> > I am new to this code. Can you help me understand why frag needs to be
> > updated too? My reading of this code is that frag points to frags array
> > in shared info. As long as shared info pointer remain the same frag
> > pointer should remain valid.
> >
>
> skb_copy_ubufs() could actually call skb_unclone() and thus skb->head
> could be re-allocated.
>
> I guess that if you run your patch (and a repro of the bug ?) with
> KASAN enabled kernel, you should see a possible use-after-free ?
>
> To force the skb_unclone() path, having a tcpdump catching all packets
> would be enough I think.
>
Okay, I see it now. I have not tested this patch with tcpdump capturing
packets at the same time. Also, during my testing I have not seen the
value of skb->head changnig. Now you are mentioning it it, I will make
sure to test with tcpdump running and see skb->head changing. Thank you
for pointing that out.
For frag, I guess something like frag = &skb_shinfo(list_skb)->frags[i];
should do the job. I have not tested it though. I will need to do more
testing before posting updated patch.
next prev parent reply other threads:[~2023-08-29 9:31 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-08-28 23:32 [PATCH] skbuff: skb_segment, Update nfrags after calling zero copy functions Mohamed Khalfella
2023-08-29 4:18 ` willemjdebruijn
2023-08-29 6:50 ` Mohamed Khalfella
2023-08-29 8:07 ` Eric Dumazet
2023-08-29 9:31 ` Mohamed Khalfella [this message]
2023-08-29 10:09 ` Eric Dumazet
2023-08-29 22:24 ` Mohamed Khalfella
2023-08-30 3:44 ` Eric Dumazet
2023-08-30 23:28 ` [PATCH v2] skbuff: skb_segment, Call zero copy functions before using skbuff frags Mohamed Khalfella
2023-08-31 6:58 ` Eric Dumazet
2023-08-31 7:29 ` Mohamed Khalfella
2023-08-31 7:43 ` Eric Dumazet
2023-08-31 8:17 ` [PATCH v3] " Mohamed Khalfella
2023-08-31 8:47 ` Eric Dumazet
2023-09-01 7:10 ` patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230829093105.GA611013@medusa \
--to=mkhalfella@purestorage.com \
--cc=alexanderduyck@fb.com \
--cc=bpf@vger.kernel.org \
--cc=brouer@redhat.com \
--cc=davem@davemloft.net \
--cc=dhowells@redhat.com \
--cc=edumazet@google.com \
--cc=keescook@chromium.org \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=willemb@google.com \
--cc=willemdebruijn.kernel@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).