From: linmiaohe <linmiaohe@huawei.com>
To: <davem@davemloft.net>, <pabeni@redhat.com>, <willemb@google.com>,
<fw@strlen.de>, <pablo@netfilter.org>, <edumazet@google.com>,
<steffen.klassert@secunet.com>, <Jason@zx2c4.com>,
<rdunlap@infradead.org>, <decui@microsoft.com>,
<jakub@cloudflare.com>, <jeremy@azazel.net>,
<mashirle@us.ibm.com>
Cc: <linux-kernel@vger.kernel.org>, <linmiaohe@huawei.com>
Subject: [PATCH 1/5] net: Fix potential deadloop in skb_copy_ubufs()
Date: Thu, 6 Aug 2020 19:50:42 +0800 [thread overview]
Message-ID: <1596714642-25183-1-git-send-email-linmiaohe@huawei.com> (raw)
From: Miaohe Lin <linmiaohe@huawei.com>
We could be trapped in deadloop when we try to copy userspace skb frags
buffers to kernel with a cloned skb:
[kbox] catch panic event, panic reason:kernel stack overflow
[kbox] catch panic event, start logging.
CPU: 3 PID: 4083 Comm: insmod Kdump: loaded Tainted: G OE 4.19 #6
Hardware name: linux,dummy-virt (DT)
Call trace:
dump_backtrace+0x0/0x198
show_stack+0x24/0x30
dump_stack+0xa4/0xcc
kbox_panic_notifier_callback+0x1d0/0x310 [kbox]
notifier_call_chain+0x5c/0xa0
atomic_notifier_call_chain+0x3c/0x50
panic+0x164/0x314
__stack_chk_fail+0x0/0x28
handle_bad_stack+0xfc/0x108
__bad_stack+0x90/0x94
pskb_expand_head+0x0/0x2c8
pskb_expand_head+0x290/0x2c8
skb_copy_ubufs+0x3cc/0x520
pskb_expand_head+0x290/0x2c8
skb_copy_ubufs+0x3cc/0x520
pskb_expand_head+0x290/0x2c8
skb_copy_ubufs+0x3cc/0x520
pskb_expand_head+0x290/0x2c8
skb_copy_ubufs+0x3cc/0x520
...
pskb_expand_head+0x290/0x2c8
skb_copy_ubufs+0x3cc/0x520
...
Reproduce code snippet:
skb = alloc_skb(UBUF_DATA_LEN, GFP_ATOMIC);
clone = skb_clone(skb, GFP_ATOMIC);
skb_zcopy_set_nouarg(clone, NULL);
pskb_expand_head(skb, 0, 0, GFP_ATOMIC);
Catch this unexpected case and return -EINVAL in skb_orphan_frags() before
we call skb_copy_ubufs() to fix it.
Fixes: a6686f2f382b ("skbuff: skb supports zero-copy buffers")
Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
---
include/linux/skbuff.h | 3 +++
1 file changed, 3 insertions(+)
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 0c0377fc00c2..167c8f4cb6e3 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -2753,6 +2753,9 @@ static inline int skb_orphan_frags(struct sk_buff *skb, gfp_t gfp_mask)
if (!skb_zcopy_is_nouarg(skb) &&
skb_uarg(skb)->callback == sock_zerocopy_callback)
return 0;
+ /* If the skb is cloned, return error here or we will be trapped in deadloop. */
+ if (unlikely(skb_cloned(skb)))
+ return -EINVAL;
return skb_copy_ubufs(skb, gfp_mask);
}
--
2.19.1
next reply other threads:[~2020-08-06 20:01 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-08-06 11:50 linmiaohe [this message]
2020-08-06 12:25 ` [PATCH 1/5] net: Fix potential deadloop in skb_copy_ubufs() Willem de Bruijn
2020-08-07 9:48 linmiaohe
2020-08-14 7:14 linmiaohe
2020-08-14 15:14 ` Eric Dumazet
2020-08-15 2:18 linmiaohe
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1596714642-25183-1-git-send-email-linmiaohe@huawei.com \
--to=linmiaohe@huawei.com \
--cc=Jason@zx2c4.com \
--cc=davem@davemloft.net \
--cc=decui@microsoft.com \
--cc=edumazet@google.com \
--cc=fw@strlen.de \
--cc=jakub@cloudflare.com \
--cc=jeremy@azazel.net \
--cc=linux-kernel@vger.kernel.org \
--cc=mashirle@us.ibm.com \
--cc=pabeni@redhat.com \
--cc=pablo@netfilter.org \
--cc=rdunlap@infradead.org \
--cc=steffen.klassert@secunet.com \
--cc=willemb@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).