CVE-2022-50483

In the Linux kernel, the following vulnerability has been resolved:

net: enetc: avoid buffer leaks on xdp_do_redirect() failure

Before enetc_clean_rx_ring_xdp() calls xdp_do_redirect(), each software BD in the RX ring between index orig_i and i can have one of 2 refcount values on its page.

We are the owner of the current buffer that is being processed, so the refcount will be at least 1.

If the current owner of the buffer at the diametrically opposed index in the RX ring (i.o.w, the other half of this page) has not yet called kfree(), this pages refcount could even be 2.

enetc_page_reusable() in enetc_flip_rx_buff() tests for the page refcount against 1, and [ if its 2 ] does not attempt to reuse it.

But if enetc_flip_rx_buff() is put after the xdp_do_redirect() call, the page refcount can have one of 3 values. It can also be 0, if there is no owner of the other page half, and xdp_do_redirect() for this buffer ran so far that it triggered a flush of the devmap/cpumap bulk queue, and the consumers of those bulk queues also freed the buffer, all by the time xdp_do_redirect() returns the execution back to enetc.

This is the reason why enetc_flip_rx_buff() is called before xdp_do_redirect(), but there is a big flaw with that reasoning: enetc_flip_rx_buff() will set rx_swbd->page = NULL on both sides of the enetc_page_reusable() branch, and if xdp_do_redirect() returns an error, we call enetc_xdp_free(), which does not deal gracefully with that.

In fact, what happens is quite special. The page refcounts start as 1. enetc_flip_rx_buff() figures theyre reusable, transfers these rx_swbd->page pointers to a different rx_swbd in enetc_reuse_page(), and bumps the refcount to 2. When xdp_do_redirect() later returns an error, we call the no-op enetc_xdp_free(), but we still havent lost the reference to that page. A copy of it is still at rx_ring->next_to_alloc, but that has refcount 2 (and there are no concurrent owners of it in flight, to drop the refcount). What really kills the system is when well flip the rx_swbd->page the second time around. With an updated refcount of 2, the page will not be reusable and well really leak it. Then enetc_new_page() will have to allocate more pages, which will then eventually leak again on further errors from xdp_do_redirect().

The problem, summarized, is that we zeroize rx_swbd->page before were completely done with it, and this makes it impossible for the error path to do something with it.

Since the packet is potentially multi-buffer and therefore the rx_swbd->page is potentially an array, manual passing of the old pointers between enetc_flip_rx_buff() and enetc_xdp_free() is a bit difficult.

For the sake of going with a simple solution, we accept the possibility of racing with xdp_do_redirect(), and we move the flip procedure to execute only on the redirect success path. By racing, I mean that the page may be deemed as not reusable by enetc (having a refcount of 0), but there will be no leak in that case, either.

Once we accept that, we have something better to do with buffers on XDP_REDIRECT failure. Since we havent performed half-page flipping yet, we wont, either (and this way, we can avoid enetc_xdp_free() completely, which gives the entire page to the slab allocator). Instead, well call enetc_xdp_drop(), which will recycle this half of the buffer back to the RX ring.

Affected Software

References

• https://git.kernel.org/stable/c/306526331e7a37e714e11ab7c6d73eb004745224
• https://git.kernel.org/stable/c/628050ec952d2e2e46ec9fb6aa07e41139e030c8
• https://git.kernel.org/stable/c/7fba523b51ccce5f7981f8a43ad84d664da68131
• https://git.kernel.org/stable/c/bcf2c1dc5358dcf7e34a68cdb6b0bbf967801efa