bpf.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Will Deacon <will@kernel.org>
To: Jason Wang <jasowang@redhat.com>
Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
	bpf@vger.kernel.org, kernel-team@android.com,
	"David S. Miller" <davem@davemloft.net>,
	Alexei Starovoitov <ast@kernel.org>,
	Daniel Borkmann <daniel@iogearbox.net>,
	Eric Dumazet <edumazet@google.com>
Subject: Re: [RFC PATCH] tun: Don't put_page() for all negative return values from XDP program
Date: Tue, 31 Mar 2020 13:14:39 +0100	[thread overview]
Message-ID: <20200331121438.GA30061@willie-the-truck> (raw)
In-Reply-To: <fd4d792f-32df-953a-a076-c09ed5dea573@redhat.com>

On Tue, Mar 31, 2020 at 10:59:01AM +0800, Jason Wang wrote:
> On 2020/3/31 上午12:12, Will Deacon wrote:
> > When an XDP program is installed, tun_build_skb() grabs a reference to
> > the current page fragment page if the program returns XDP_REDIRECT or
> > XDP_TX. However, since tun_xdp_act() passes through negative return
> > values from the XDP program, it is possible to trigger the error path by
> > mistake and accidentally drop a reference to the fragments page without
> > taking one, leading to a spurious free. This is believed to be the cause
> > of some KASAN use-after-free reports from syzbot [1], although without a
> > reproducer it is not possible to confirm whether this patch fixes the
> > problem.
> > 
> > Ensure that we only drop a reference to the fragments page if the XDP
> > transmit or redirect operations actually fail.
> > 
> > [1] https://syzkaller.appspot.com/bug?id=e76a6af1be4acd727ff6bbca669833f98cbf5d95
> 
> 
> I think the patch fixes the issue reported. Since I can see the warn of bad
> page state in put_page().

[...]

> Acked-by: Jason Wang <jasowang@redhat.com>

Thanks, Jason. In which case, I'll add this tag along with:

Fixes: 8ae1aff0b331 ("tuntap: split out XDP logic")

Will

      reply	other threads:[~2020-03-31 12:14 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-03-30 16:12 [RFC PATCH] tun: Don't put_page() for all negative return values from XDP program Will Deacon
2020-03-31  2:59 ` Jason Wang
2020-03-31 12:14   ` Will Deacon [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200331121438.GA30061@willie-the-truck \
    --to=will@kernel.org \
    --cc=ast@kernel.org \
    --cc=bpf@vger.kernel.org \
    --cc=daniel@iogearbox.net \
    --cc=davem@davemloft.net \
    --cc=edumazet@google.com \
    --cc=jasowang@redhat.com \
    --cc=kernel-team@android.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).