In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
packet: use ubuf_info completion for TX_RING packets<\/p>\n
tpacket_snd sends skbs with frags pointing into its ring slots. Slots
\nare released when skb->destructor is called.<\/p>\n
A call to skb_orphan calls skb->destructor before the skb is freed.
\nThis can cause the slot to be reused while still linked into the skb.<\/p>\n
Switch to standard zerocopy completion (ubuf_info) so the slot is only
\nreleased once all references to the payload are freed or copied.
\nRestore skb->destructor to standard sock_wfree.<\/p>\n
The ubuf_info completion callback can be called with a NULL skb, but
\nonly from net_zcopy_put and related API, used by zerocopy implementations
\nthat hold their own reference on the uarg, such as MSG_ZEROCOPY. This
\nuarg is only ever completed from skb_zcopy_clear, so skb is always set.<\/p>\n
To prevent userspace from aliasing in-flight state on shared ring
\nslots, allocate tpacket_uarg per packet, rather than per slot. This
\nadds a small allocation to the transmit path. Use standard kmalloc to
\nallow backporting to stable kernels.<\/p>\n
The uarg holds an sk_wmem_alloc reference, rather than an sk_refcnt
\nreference. packet_free_tx_ring waits on sk_wmem_alloc before freeing
\nthe ring pages. Always allocate vec->deferred for tx_ring so page-backed
\nrings also wait on sk_wmem_alloc when skb_copy_ubufs drops page refs
\nbefore calling tpacket_ubuf_complete.<\/p>\n
Drop the tx_ring.pg_vec test that tpacket_destruct_skb performed before
\naccessing the slot. The sk_wmem_alloc reference now guarantees that the
\nslot is valid. The test is also not sufficient by itself, as it reads
\npg_vec without pg_vec_lock, so it can race with packet_set_ring.<\/p>\n
As a result a slot is released when its payload is copied, which can
\nbe before transmission (e.g., in skb_orphan_frags_rx). If copied
\nbefore skb_tx_timestamp() is called, no slot timestamp is recorded,
\nsimilar to when skb_orphan() was called early in the datapath before
\nthis patch.<\/p>\n
Revert the now unused previous skb_zcopy_.._nouarg infra.<\/p>\n
Depends on commit 992cc9f94ca9 (“net\/packet: defer vmalloc TX_RING
\nfree until skbs finish”).<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
packet: use ubuf_info completion for TX_RING packets<\/p>\n
tpacket_snd sends skbs with frags pointing into its ring slots. Slots
\nare rel<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-40975","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/40975","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=40975"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=40975"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=40975"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}