* [net-next PATCH] bpf: reserve xdp_frame size in xdp headroom
@ 2018-04-19 14:17 Jesper Dangaard Brouer
2018-04-19 15:55 ` Daniel Borkmann
0 siblings, 1 reply; 2+ messages in thread
From: Jesper Dangaard Brouer @ 2018-04-19 14:17 UTC (permalink / raw)
To: Daniel Borkmann, Alexei Starovoitov; +Cc: netdev, Jesper Dangaard Brouer
Commit 6dfb970d3dbd ("xdp: avoid leaking info stored in frame data on
page reuse") tried to allow user/bpf_prog to (re)use area used by
xdp_frame (stored in frame headroom), by memset clearing area when
bpf_xdp_adjust_head give bpf_prog access to headroom area.
The mentioned commit had two bugs. (1) Didn't take bpf_xdp_adjust_meta
into account. (2) a combination of bpf_xdp_adjust_head calls, where
xdp->data is moved into xdp_frame section, can cause clearing
xdp_frame area again for area previously granted to bpf_prog.
After discussions with Daniel, we choose to implement a simpler
solution to the problem, which is to reserve the headroom used by
xdp_frame info.
This also avoids the situation where bpf_prog is allowed to adjust/add
headers, and then XDP_REDIRECT later drops the packet due to lack of
headroom for the xdp_frame. This would likely confuse the end-user.
Fixes: 6dfb970d3dbd ("xdp: avoid leaking info stored in frame data on page reuse")
Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
---
net/core/filter.c | 12 +++---------
1 file changed, 3 insertions(+), 9 deletions(-)
diff --git a/net/core/filter.c b/net/core/filter.c
index a374b8560bc4..6398d2443f9f 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2694,20 +2694,13 @@ BPF_CALL_2(bpf_xdp_adjust_head, struct xdp_buff *, xdp, int, offset)
{
void *xdp_frame_end = xdp->data_hard_start + sizeof(struct xdp_frame);
unsigned long metalen = xdp_get_metalen(xdp);
- void *data_start = xdp->data_hard_start + metalen;
+ void *data_start = xdp_frame_end + metalen;
void *data = xdp->data + offset;
if (unlikely(data < data_start ||
data > xdp->data_end - ETH_HLEN))
return -EINVAL;
- /* Avoid info leak, when reusing area prev used by xdp_frame */
- if (data < xdp_frame_end) {
- unsigned long clearlen = xdp_frame_end - data;
-
- memset(data, 0, clearlen);
- }
-
if (metalen)
memmove(xdp->data_meta + offset,
xdp->data_meta, metalen);
@@ -2727,12 +2720,13 @@ static const struct bpf_func_proto bpf_xdp_adjust_head_proto = {
BPF_CALL_2(bpf_xdp_adjust_meta, struct xdp_buff *, xdp, int, offset)
{
+ void *xdp_frame_end = xdp->data_hard_start + sizeof(struct xdp_frame);
void *meta = xdp->data_meta + offset;
unsigned long metalen = xdp->data - meta;
if (xdp_data_meta_unsupported(xdp))
return -ENOTSUPP;
- if (unlikely(meta < xdp->data_hard_start ||
+ if (unlikely(meta < xdp_frame_end ||
meta > xdp->data))
return -EINVAL;
if (unlikely((metalen & (sizeof(__u32) - 1)) ||
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [net-next PATCH] bpf: reserve xdp_frame size in xdp headroom
2018-04-19 14:17 [net-next PATCH] bpf: reserve xdp_frame size in xdp headroom Jesper Dangaard Brouer
@ 2018-04-19 15:55 ` Daniel Borkmann
0 siblings, 0 replies; 2+ messages in thread
From: Daniel Borkmann @ 2018-04-19 15:55 UTC (permalink / raw)
To: Jesper Dangaard Brouer, Daniel Borkmann, Alexei Starovoitov; +Cc: netdev
On 04/19/2018 04:17 PM, Jesper Dangaard Brouer wrote:
> Commit 6dfb970d3dbd ("xdp: avoid leaking info stored in frame data on
> page reuse") tried to allow user/bpf_prog to (re)use area used by
> xdp_frame (stored in frame headroom), by memset clearing area when
> bpf_xdp_adjust_head give bpf_prog access to headroom area.
>
> The mentioned commit had two bugs. (1) Didn't take bpf_xdp_adjust_meta
> into account. (2) a combination of bpf_xdp_adjust_head calls, where
> xdp->data is moved into xdp_frame section, can cause clearing
> xdp_frame area again for area previously granted to bpf_prog.
>
> After discussions with Daniel, we choose to implement a simpler
> solution to the problem, which is to reserve the headroom used by
> xdp_frame info.
>
> This also avoids the situation where bpf_prog is allowed to adjust/add
> headers, and then XDP_REDIRECT later drops the packet due to lack of
> headroom for the xdp_frame. This would likely confuse the end-user.
>
> Fixes: 6dfb970d3dbd ("xdp: avoid leaking info stored in frame data on page reuse")
> Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
Applied to bpf-next, thanks Jesper!
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2018-04-19 15:55 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-04-19 14:17 [net-next PATCH] bpf: reserve xdp_frame size in xdp headroom Jesper Dangaard Brouer
2018-04-19 15:55 ` Daniel Borkmann
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.