From: Daniel Borkmann <daniel@iogearbox•net>
To: Ken-ichirou MATSUZAWA <chamaken@gmail•com>
Cc: David Miller <davem@davemloft•net>, netdev@vger•kernel.org, fw@strlen•de
Subject: Re: [PATCHv1 net-next 0/5] netlink: mmap: kernel panic and some issues
Date: Wed, 02 Sep 2015 17:56:36 +0200 [thread overview]
Message-ID: <55E71C34.1080504@iogearbox.net> (raw)
In-Reply-To: <20150902113553.GA3282@gmail.com>
On 09/02/2015 01:35 PM, Ken-ichirou MATSUZAWA wrote:
> Thank you for the reply.
>
> On Wed, Sep 02, 2015 at 11:47:26AM +0200, Daniel Borkmann wrote:
>> On 09/02/2015 02:04 AM, Ken-ichirou MATSUZAWA wrote:
>>> Talking about skb_copy path, original skb's shared info is accessed
>>> only in copy_skb_header, to get gso related field. As a result of
>>
>> It's still not correct. The thing is you can neither call skb_copy() nor
>> skb_clone() on netlink mmaped skbs. For example, skb_copy_bits() would
>
> I am sorry for the lack of explanation.
> And I am afraid I misunderstand...
>
> Updated pointers to its data area in a mmaped netlink skb is only
> its tail. Head, data and end will not be updated. skb_copy() calls
>
> int skb_copy_bits(const struct sk_buff *skb, int offset, void *to, int len)
>
> as its argument, "offset" is always 0 and "len" is skb->len. In
> skb_copy_bits() both "start" and "copy" are skb->len, which means
> "len - copy" is always 0 so that retuns 0 before accessing shared
> info.
>
> I don't know the situation is intended or not, it seems that
> skb_copy() for a mmaped skb will not access its shared info.
Okay, right, since it's all linear, but ...
> After that, copy_skb_header() will set newly allocate skb's (wrong)
> gso fields, I asked we should clear it or not.
... here still we access skb_shinfo() from the mmap'ed skb, which we
are simply not allowed (despite whether resetting fields later on as
you suggest or not), for two reasons: I think (will start experimenting
more with it tomorrow), you would get an out of bounds access here in
case the skb->data is the last slot in the ring buffer and reaches
exactly to the ring buffer end. And (despite that), it's also hard
to maintain - the next one adding a new shared info member will very
likely oversee this special case in netlink here, thus the issue would
then simply be reintroduced over and over.
Thanks,
Daniel
next prev parent reply other threads:[~2015-09-02 15:56 UTC|newest]
Thread overview: 35+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-07-22 13:17 [RFC PATCH 0/5] netlink: mmap kernel panic and some issues Ken-ichirou MATSUZAWA
2015-08-12 8:28 ` [PATCHv1 net-next 0/5] netlink: mmap: " Ken-ichirou MATSUZAWA
2015-08-12 8:31 ` [PATCHv1 net-next 1/5] netlink: mmap: introduce mmaped skb helper functions Ken-ichirou MATSUZAWA
2015-08-12 8:32 ` [PATCHv1 net-next 2/5] netlink: mmap: apply " Ken-ichirou MATSUZAWA
2015-08-12 8:34 ` [PATCHv1 net-next 3/5] netlink: mmap: fix status for not delivered skb Ken-ichirou MATSUZAWA
2015-08-12 8:35 ` [PATCHv1 net-next 4/5] netlink: mmap: update tx type check Ken-ichirou MATSUZAWA
2015-08-12 8:38 ` [PATCHv1 net-next 5/5] netlink: mmap: notify only when NL_MMAP_STATUS_VALID frame exists Ken-ichirou MATSUZAWA
2015-08-12 23:38 ` [PATCHv1 net-next 0/5] netlink: mmap: kernel panic and some issues David Miller
2015-08-14 8:58 ` Ken-ichirou MATSUZAWA
2015-08-14 10:01 ` Daniel Borkmann
2015-08-14 10:38 ` Daniel Borkmann
2015-08-15 2:25 ` Ken-ichirou MATSUZAWA
2015-08-17 21:02 ` David Miller
2015-08-19 14:29 ` Daniel Borkmann
2015-09-02 0:04 ` Ken-ichirou MATSUZAWA
2015-09-02 9:47 ` Daniel Borkmann
2015-09-02 11:35 ` Ken-ichirou MATSUZAWA
2015-09-02 15:56 ` Daniel Borkmann [this message]
2015-09-02 22:27 ` Ken-ichirou MATSUZAWA
2015-09-07 14:54 ` Daniel Borkmann
2015-09-09 5:59 ` David Miller
2015-09-09 8:53 ` Thomas Graf
2015-09-09 9:22 ` Daniel Borkmann
2015-08-20 3:43 ` [PATCH net] netlink: mmap: fix tx type check Ken-ichirou MATSUZAWA
2015-08-23 23:06 ` David Miller
2015-08-20 5:54 ` [PATCH net] netlink: rx mmap: fix POLLIN condition Ken-ichirou MATSUZAWA
2015-08-26 3:17 ` David Miller
2015-08-28 7:00 ` Ken-ichirou MATSUZAWA
2015-08-28 7:05 ` [PATCH net] netlink: mmap: fix lookup frame position Ken-ichirou MATSUZAWA
2015-08-29 5:26 ` David Miller
2015-08-30 22:54 ` [PATCH net] netlink: rx mmap: fix POLLIN condition Ken-ichirou MATSUZAWA
2015-08-31 4:56 ` David Miller
2015-08-20 7:07 ` [PATCH net] netlink: mmap: fix status setting in skb destructor Ken-ichirou MATSUZAWA
2015-08-26 3:22 ` David Miller
2015-08-28 7:37 ` Ken-ichirou MATSUZAWA
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=55E71C34.1080504@iogearbox.net \
--to=daniel@iogearbox$(echo .)net \
--cc=chamaken@gmail$(echo .)com \
--cc=davem@davemloft$(echo .)net \
--cc=fw@strlen$(echo .)de \
--cc=netdev@vger$(echo .)kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox