From patchwork Thu Mar 29 03:51:03 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dongli Zhang X-Patchwork-Id: 892553 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=oracle.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=oracle.com header.i=@oracle.com header.b="vtE29fze"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 40BW4L3qn1z9ryk for ; Thu, 29 Mar 2018 14:50:42 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751193AbeC2DuL (ORCPT ); Wed, 28 Mar 2018 23:50:11 -0400 Received: from aserp2130.oracle.com ([141.146.126.79]:38656 "EHLO aserp2130.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751085AbeC2DuK (ORCPT ); Wed, 28 Mar 2018 23:50:10 -0400 Received: from pps.filterd (aserp2130.oracle.com [127.0.0.1]) by aserp2130.oracle.com (8.16.0.22/8.16.0.22) with SMTP id w2T3ileh035681; Thu, 29 Mar 2018 03:50:06 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id; s=corp-2017-10-26; bh=zd5OMLxo6mwK8snGQloLas7lOchyzycBXzgZx0SZ0xk=; b=vtE29fzePJjgrCwYVq5MN/rqiILhgB9e2+75XClJDiLsgvUj9sWREBl4XoUJ5Uu97LYz URxGZ0190XGU7y5pWAaWtnF6AqYlwVlShSCJ1pDFwJ43BAgHkiOqWnSuttBv/WDitMW2 DHQedUvz844IW8xbFoh0/XxbcWy/5afgJV4b1naHbB8B+EFMpwlC0DadAVolIrOrk8uT 8NcPjnKaHY//xJTwBXsgwZcC+0TFVGHwujshe3dqb4U+jOxfZNNde02F92XH5VFshM3Y EOEJAPcJfaxKHjWAkQ1sJvcQTL1bBE7T8DG5zZ1f8zcGtgZRgZVJHYbTYkz/qoWfDcRk LQ== Received: from userv0022.oracle.com (userv0022.oracle.com [156.151.31.74]) by aserp2130.oracle.com with ESMTP id 2h0rgt8082-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 29 Mar 2018 03:50:05 +0000 Received: from aserv0121.oracle.com (aserv0121.oracle.com [141.146.126.235]) by userv0022.oracle.com (8.14.4/8.14.4) with ESMTP id w2T3o4UC002015 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 29 Mar 2018 03:50:05 GMT Received: from abhmp0014.oracle.com (abhmp0014.oracle.com [141.146.116.20]) by aserv0121.oracle.com (8.14.4/8.13.8) with ESMTP id w2T3o3ni027638; Thu, 29 Mar 2018 03:50:04 GMT Received: from linux.cn.oracle.com (/10.182.69.93) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 28 Mar 2018 20:50:03 -0700 From: Dongli Zhang To: xen-devel@lists.xenproject.org, linux-kernel@vger.kernel.org Cc: netdev@vger.kernel.org, paul.durrant@citrix.com, wei.liu2@citrix.com Subject: [PATCH v2 1/1] xen-netback: process malformed sk_buff correctly to avoid BUG_ON() Date: Thu, 29 Mar 2018 11:51:03 +0800 Message-Id: <1522295463-469-1-git-send-email-dongli.zhang@oracle.com> X-Mailer: git-send-email 2.7.4 X-Proofpoint-Virus-Version: vendor=nai engine=5900 definitions=8846 signatures=668695 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1711220000 definitions=main-1803290033 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org The "BUG_ON(!frag_iter)" in function xenvif_rx_next_chunk() is triggered if the received sk_buff is malformed, that is, when the sk_buff has pattern (skb->data_len && !skb_shinfo(skb)->nr_frags). Below is a sample call stack: [ 438.652658] ------------[ cut here ]------------ [ 438.652660] kernel BUG at drivers/net/xen-netback/rx.c:325! [ 438.652714] invalid opcode: 0000 [#1] SMP NOPTI [ 438.652813] CPU: 0 PID: 2492 Comm: vif1.0-q0-guest Tainted: G O 4.16.0-rc6+ #1 [ 438.652896] RIP: e030:xenvif_rx_skb+0x3c2/0x5e0 [xen_netback] [ 438.652926] RSP: e02b:ffffc90040877dc8 EFLAGS: 00010246 [ 438.652956] RAX: 0000000000000160 RBX: 0000000000000022 RCX: 0000000000000001 [ 438.652993] RDX: ffffc900402890d0 RSI: 0000000000000000 RDI: ffffc90040889000 [ 438.653029] RBP: ffff88002b460040 R08: ffffc90040877de0 R09: 0100000000000000 [ 438.653065] R10: 0000000000007ff0 R11: 0000000000000002 R12: ffffc90040889000 [ 438.653100] R13: ffffffff80000000 R14: 0000000000000022 R15: 0000000080000000 [ 438.653149] FS: 00007f15603778c0(0000) GS:ffff880030400000(0000) knlGS:0000000000000000 [ 438.653188] CS: e033 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 438.653219] CR2: 0000000001832a08 CR3: 0000000029c12000 CR4: 0000000000042660 [ 438.653262] Call Trace: [ 438.653284] ? xen_hypercall_event_channel_op+0xa/0x20 [ 438.653313] xenvif_rx_action+0x41/0x80 [xen_netback] [ 438.653341] xenvif_kthread_guest_rx+0xb2/0x2a8 [xen_netback] [ 438.653374] ? __schedule+0x352/0x700 [ 438.653398] ? wait_woken+0x80/0x80 [ 438.653421] kthread+0xf3/0x130 [ 438.653442] ? xenvif_rx_action+0x80/0x80 [xen_netback] [ 438.653470] ? kthread_destroy_worker+0x40/0x40 [ 438.653497] ret_from_fork+0x35/0x40 The issue is hit by xen-netback when there is bug with other networking interface (e.g., dom0 physical NIC), who has generated and forwarded malformed sk_buff to dom0 vifX.Y. It is possible to reproduce the issue on purpose with below sample code in a kernel module: skb->dev = dev; // dev of vifX.Y skb->len = 386; skb->data_len = 352; skb->tail = 98; skb->end = 384; skb_shinfo(skb)->nr_frags = 0; dev->netdev_ops->ndo_start_xmit(skb, dev); This patch stops processing sk_buff immediately if it is detected as malformed, that is, pkt->frag_iter is NULL but there is still remaining pkt->remaining_len. Signed-off-by: Dongli Zhang --- Changed since v1: * return XEN_NETIF_RSP_ERROR in response to netfront drivers/net/xen-netback/rx.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/drivers/net/xen-netback/rx.c b/drivers/net/xen-netback/rx.c index b1cf7c6..a3d8ee9 100644 --- a/drivers/net/xen-netback/rx.c +++ b/drivers/net/xen-netback/rx.c @@ -358,6 +358,7 @@ static void xenvif_rx_data_slot(struct xenvif_queue *queue, { unsigned int offset = 0; unsigned int flags; + bool err = false; do { size_t len; @@ -369,6 +370,15 @@ static void xenvif_rx_data_slot(struct xenvif_queue *queue, offset += len; pkt->remaining_len -= len; + if (unlikely(!pkt->frag_iter && pkt->remaining_len)) { + pkt->remaining_len = 0; + pkt->extra_count = 0; + err = true; + pr_err_ratelimited("malformed sk_buff at %s\n", + queue->name); + break; + } + } while (offset < XEN_PAGE_SIZE && pkt->remaining_len > 0); if (pkt->remaining_len > 0) @@ -392,7 +402,7 @@ static void xenvif_rx_data_slot(struct xenvif_queue *queue, rsp->offset = 0; rsp->flags = flags; rsp->id = req->id; - rsp->status = (s16)offset; + rsp->status = likely(!err) ? (s16)offset : XEN_NETIF_RSP_ERROR; } static void xenvif_rx_extra_slot(struct xenvif_queue *queue,