From nobody Mon Feb 9 14:38:12 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=pass(p=quarantine dis=none) header.from=suse.com ARC-Seal: i=1; a=rsa-sha256; t=1629800915; cv=none; d=zohomail.com; s=zohoarc; b=as8nltuvZHoUqgwSLp1Cz+nOILaC2lnS9diSGhyEoGcmTxGqfB+bgt/2U6odj7yM6hJHC5MScSmfdlx+zPa8GRlH5VR0ekeC30QeYB0B1vqf5yto46xNTRbS/T4s7cC4DYzybfAN6VHgHoj/thAT1ygCoS+ZXMU5t27lAelIo6U= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1629800915; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=xzRnNXEpYNK6Fr5aUl3tWJGBJDdvhYuHIaqCmKzznYU=; b=BhZjG/27Y3fDCI0XKyhyokClTy54l/Tof4b+KEZE/kCIGNnLyv8y1xOGo/YOQAAaACfH81L4WcDs1lNkIRxqbp303Pc5Zr4AdQg5IEtP6sEGlp3i9dx/5ODsqCtdQ+6GY9kLVsWC5ayxg8DvkaeaO6m46VoivZRjGZvaVdgRb5g= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1629800915554243.89129987070203; Tue, 24 Aug 2021 03:28:35 -0700 (PDT) Received: from list by lists.xenproject.org with outflank-mailman.170855.311823 (Exim 4.92) (envelope-from ) id 1mITfG-0003IY-6S; Tue, 24 Aug 2021 10:28:18 +0000 Received: by outflank-mailman (output) from mailman id 170855.311823; Tue, 24 Aug 2021 10:28:18 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1mITfG-0003IN-1I; Tue, 24 Aug 2021 10:28:18 +0000 Received: by outflank-mailman (input) for mailman id 170855; Tue, 24 Aug 2021 10:28:16 +0000 Received: from us1-rack-iad1.inumbo.com ([172.99.69.81]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1mITfE-00031l-4Y for xen-devel@lists.xenproject.org; Tue, 24 Aug 2021 10:28:16 +0000 Received: from smtp-out1.suse.de (unknown [195.135.220.28]) by us1-rack-iad1.inumbo.com (Halon) with ESMTPS id 44d69b1b-7280-4e2d-a16d-190dcef9212e; Tue, 24 Aug 2021 10:28:14 +0000 (UTC) Received: from imap1.suse-dmz.suse.de (imap1.suse-dmz.suse.de [192.168.254.73]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by smtp-out1.suse.de (Postfix) with ESMTPS id EF470220AC; Tue, 24 Aug 2021 10:28:13 +0000 (UTC) Received: from imap1.suse-dmz.suse.de (imap1.suse-dmz.suse.de [192.168.254.73]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by imap1.suse-dmz.suse.de (Postfix) with ESMTPS id AAFBB136DD; Tue, 24 Aug 2021 10:28:13 +0000 (UTC) Received: from dovecot-director2.suse.de ([192.168.254.65]) by imap1.suse-dmz.suse.de with ESMTPSA id 6BJGKL3JJGG8DwAAGKfGzw (envelope-from ); Tue, 24 Aug 2021 10:28:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: 44d69b1b-7280-4e2d-a16d-190dcef9212e DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.com; s=susede1; t=1629800893; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=xzRnNXEpYNK6Fr5aUl3tWJGBJDdvhYuHIaqCmKzznYU=; b=Q+8gdbEVImSGds7mmPaM4UehS+aTvl6Jy+7iX7DxXXhxkZgPpS4IOcdZd25ZzMRAmjW9kb n32wpEB0gsPm6SzdwQNp6wxpOyyxsoznmynuAgqxBufivgjhWLcd+aRn5E+MizuAVJZgcV QPa5WwxRjK/QKCMDzUCCm08y/G8KCEU= From: Juergen Gross To: xen-devel@lists.xenproject.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Juergen Gross , Boris Ostrovsky , Stefano Stabellini , "David S. Miller" , Jakub Kicinski Subject: [PATCH v2 2/4] xen/netfront: don't read data from request on the ring page Date: Tue, 24 Aug 2021 12:28:07 +0200 Message-Id: <20210824102809.26370-3-jgross@suse.com> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20210824102809.26370-1-jgross@suse.com> References: <20210824102809.26370-1-jgross@suse.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ZohoMail-DKIM: pass (identity @suse.com) X-ZM-MESSAGEID: 1629800917851100003 Content-Type: text/plain; charset="utf-8" In order to avoid a malicious backend being able to influence the local processing of a request build the request locally first and then copy it to the ring page. Any reading from the request influencing the processing in the frontend needs to be done on the local instance. Signed-off-by: Juergen Gross Reviewed-by: Jan Beulich --- V2: - drop local tx variable (Jan Beulich) - fix oversight of reading value from ring page (Jan Beulich) --- drivers/net/xen-netfront.c | 86 +++++++++++++++++++------------------- 1 file changed, 42 insertions(+), 44 deletions(-) diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c index 003cdf2ffc92..714fe9d2c534 100644 --- a/drivers/net/xen-netfront.c +++ b/drivers/net/xen-netfront.c @@ -435,7 +435,8 @@ struct xennet_gnttab_make_txreq { struct netfront_queue *queue; struct sk_buff *skb; struct page *page; - struct xen_netif_tx_request *tx; /* Last request */ + struct xen_netif_tx_request *tx; /* Last request on ring page */ + struct xen_netif_tx_request tx_local; /* Last request local copy*/ unsigned int size; }; =20 @@ -463,30 +464,27 @@ static void xennet_tx_setup_grant(unsigned long gfn, = unsigned int offset, queue->grant_tx_page[id] =3D page; queue->grant_tx_ref[id] =3D ref; =20 - tx->id =3D id; - tx->gref =3D ref; - tx->offset =3D offset; - tx->size =3D len; - tx->flags =3D 0; + info->tx_local.id =3D id; + info->tx_local.gref =3D ref; + info->tx_local.offset =3D offset; + info->tx_local.size =3D len; + info->tx_local.flags =3D 0; + + *tx =3D info->tx_local; =20 info->tx =3D tx; - info->size +=3D tx->size; + info->size +=3D info->tx_local.size; } =20 static struct xen_netif_tx_request *xennet_make_first_txreq( - struct netfront_queue *queue, struct sk_buff *skb, - struct page *page, unsigned int offset, unsigned int len) + struct xennet_gnttab_make_txreq *info, + unsigned int offset, unsigned int len) { - struct xennet_gnttab_make_txreq info =3D { - .queue =3D queue, - .skb =3D skb, - .page =3D page, - .size =3D 0, - }; + info->size =3D 0; =20 - gnttab_for_one_grant(page, offset, len, xennet_tx_setup_grant, &info); + gnttab_for_one_grant(info->page, offset, len, xennet_tx_setup_grant, info= ); =20 - return info.tx; + return info->tx; } =20 static void xennet_make_one_txreq(unsigned long gfn, unsigned int offset, @@ -499,35 +497,27 @@ static void xennet_make_one_txreq(unsigned long gfn, = unsigned int offset, xennet_tx_setup_grant(gfn, offset, len, data); } =20 -static struct xen_netif_tx_request *xennet_make_txreqs( - struct netfront_queue *queue, struct xen_netif_tx_request *tx, - struct sk_buff *skb, struct page *page, +static void xennet_make_txreqs( + struct xennet_gnttab_make_txreq *info, + struct page *page, unsigned int offset, unsigned int len) { - struct xennet_gnttab_make_txreq info =3D { - .queue =3D queue, - .skb =3D skb, - .tx =3D tx, - }; - /* Skip unused frames from start of page */ page +=3D offset >> PAGE_SHIFT; offset &=3D ~PAGE_MASK; =20 while (len) { - info.page =3D page; - info.size =3D 0; + info->page =3D page; + info->size =3D 0; =20 gnttab_foreach_grant_in_range(page, offset, len, xennet_make_one_txreq, - &info); + info); =20 page++; offset =3D 0; - len -=3D info.size; + len -=3D info->size; } - - return info.tx; } =20 /* @@ -580,10 +570,14 @@ static int xennet_xdp_xmit_one(struct net_device *dev, { struct netfront_info *np =3D netdev_priv(dev); struct netfront_stats *tx_stats =3D this_cpu_ptr(np->tx_stats); + struct xennet_gnttab_make_txreq info =3D { + .queue =3D queue, + .skb =3D NULL, + .page =3D virt_to_page(xdpf->data), + }; int notify; =20 - xennet_make_first_txreq(queue, NULL, - virt_to_page(xdpf->data), + xennet_make_first_txreq(&info, offset_in_page(xdpf->data), xdpf->len); =20 @@ -638,7 +632,7 @@ static netdev_tx_t xennet_start_xmit(struct sk_buff *sk= b, struct net_device *dev { struct netfront_info *np =3D netdev_priv(dev); struct netfront_stats *tx_stats =3D this_cpu_ptr(np->tx_stats); - struct xen_netif_tx_request *tx, *first_tx; + struct xen_netif_tx_request *first_tx; unsigned int i; int notify; int slots; @@ -647,6 +641,7 @@ static netdev_tx_t xennet_start_xmit(struct sk_buff *sk= b, struct net_device *dev unsigned int len; unsigned long flags; struct netfront_queue *queue =3D NULL; + struct xennet_gnttab_make_txreq info =3D { }; unsigned int num_queues =3D dev->real_num_tx_queues; u16 queue_index; struct sk_buff *nskb; @@ -704,21 +699,24 @@ static netdev_tx_t xennet_start_xmit(struct sk_buff *= skb, struct net_device *dev } =20 /* First request for the linear area. */ - first_tx =3D tx =3D xennet_make_first_txreq(queue, skb, - page, offset, len); - offset +=3D tx->size; + info.queue =3D queue; + info.skb =3D skb; + info.page =3D page; + first_tx =3D xennet_make_first_txreq(&info, offset, len); + offset +=3D info.tx_local.size; if (offset =3D=3D PAGE_SIZE) { page++; offset =3D 0; } - len -=3D tx->size; + len -=3D info.tx_local.size; =20 if (skb->ip_summed =3D=3D CHECKSUM_PARTIAL) /* local packet? */ - tx->flags |=3D XEN_NETTXF_csum_blank | XEN_NETTXF_data_validated; + first_tx->flags |=3D XEN_NETTXF_csum_blank | + XEN_NETTXF_data_validated; else if (skb->ip_summed =3D=3D CHECKSUM_UNNECESSARY) /* remote but checksummed. */ - tx->flags |=3D XEN_NETTXF_data_validated; + first_tx->flags |=3D XEN_NETTXF_data_validated; =20 /* Optional extra info after the first request. */ if (skb_shinfo(skb)->gso_size) { @@ -727,7 +725,7 @@ static netdev_tx_t xennet_start_xmit(struct sk_buff *sk= b, struct net_device *dev gso =3D (struct xen_netif_extra_info *) RING_GET_REQUEST(&queue->tx, queue->tx.req_prod_pvt++); =20 - tx->flags |=3D XEN_NETTXF_extra_info; + first_tx->flags |=3D XEN_NETTXF_extra_info; =20 gso->u.gso.size =3D skb_shinfo(skb)->gso_size; gso->u.gso.type =3D (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6) ? @@ -741,12 +739,12 @@ static netdev_tx_t xennet_start_xmit(struct sk_buff *= skb, struct net_device *dev } =20 /* Requests for the rest of the linear area. */ - tx =3D xennet_make_txreqs(queue, tx, skb, page, offset, len); + xennet_make_txreqs(&info, page, offset, len); =20 /* Requests for all the frags. */ for (i =3D 0; i < skb_shinfo(skb)->nr_frags; i++) { skb_frag_t *frag =3D &skb_shinfo(skb)->frags[i]; - tx =3D xennet_make_txreqs(queue, tx, skb, skb_frag_page(frag), + xennet_make_txreqs(&info, skb_frag_page(frag), skb_frag_off(frag), skb_frag_size(frag)); } --=20 2.26.2