From patchwork Mon Nov 19 17:56:45 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ilya Dryomov X-Patchwork-Id: 10689223 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 17FA45A4 for ; Mon, 19 Nov 2018 17:57:00 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 05EC0294A6 for ; Mon, 19 Nov 2018 17:57:00 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id EE0C12950E; Mon, 19 Nov 2018 17:56:59 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FROM,MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 91A1F294A6 for ; Mon, 19 Nov 2018 17:56:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731367AbeKTEVa (ORCPT ); Mon, 19 Nov 2018 23:21:30 -0500 Received: from mail-wm1-f68.google.com ([209.85.128.68]:38548 "EHLO mail-wm1-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730591AbeKTEV3 (ORCPT ); Mon, 19 Nov 2018 23:21:29 -0500 Received: by mail-wm1-f68.google.com with SMTP id k198so5733273wmd.3 for ; Mon, 19 Nov 2018 09:56:56 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:subject:date:message-id; bh=sqPa3Zf6z/AtvQEYYoLvo/QairjQlCEzWUuoPT5Rf/g=; b=QSNwhaYRhBALsjTf9Fa4MCQXV6C4eZvQRm7xnLZH4oJR/faeMwI1T/814mM4ieB4Vn iehl2m787n6m6mZ+ZC7idzi2UjqPss0er0MQc2c7rV89SwUyqKdXhr8jKVVZSAgiltU2 j3IWG7ZtZAnTqGnEfw2IsWzw+Jjyn0WBc+WMDZ5X3rESAqRTU3HBEqO5Pk7/fjmfEAPu Ps8EoII/JfbQsYLV4Zt089AYlacWSwvd3mOCHwdqp7NiLzb8n0YXp8qPN26b7Wc0AcZg 2s23EyJNPr+nnXrNRxEmrXhVYTTwO7bDyJuPxcdio15y4dcoXIT2eQ7yDeObWQENTfnD QQqg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:message-id; bh=sqPa3Zf6z/AtvQEYYoLvo/QairjQlCEzWUuoPT5Rf/g=; b=JCQIDSFE+JH92O3lmr0UpBgGmXKFeTDL1mx8pChBVAC156/oVF/uWK+JUZ17xM+zSG 6/5ZAF+XXUdat3K+ZnBLZkiHkOir5Cq9w8jUrtQ5ENh/zU7w4bi4/mLYaYcnRUD6sBaV qbuzpCw7MPmETMJ0931pH7/wR3Zd9oFyDAgYDi0PSJhiB8yCncEFkVa9ikF7qpgB7g4x k/3n1GcyctRsBJh/EY4Yv7Ggzo0fmRAJ5QMKg00Sj6iMrWI+zAEk1oFtzDO1a1w/GJjH lTL/cF84W/EZ91iWldn+2y+3UPKObfPvyw7ledg4J52dhZZ6lxLkTcq8qqRVth6Fd40y nRyw== X-Gm-Message-State: AA+aEWZNGuDtLVuo3VrhYuVMlkYuw1JUEFnYtrgD9VoKgUHSdRu5d/jA oBT8kr1WpJbzc5Sanz6ru34WgvHm X-Google-Smtp-Source: AFSGD/UFYRO7kzBXYk9BnWP3mYKVyPfTTfEs4N8o3GNy2tCwWJm+hnb3XAY64cE+xSp7sIU/DjH8MQ== X-Received: by 2002:a1c:1dce:: with SMTP id d197mr8504708wmd.66.1542650215127; Mon, 19 Nov 2018 09:56:55 -0800 (PST) Received: from orange.redhat.com (ovpn-brq.redhat.com. [213.175.37.11]) by smtp.gmail.com with ESMTPSA id t5sm20596890wmd.15.2018.11.19.09.56.53 for (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Mon, 19 Nov 2018 09:56:54 -0800 (PST) From: Ilya Dryomov To: ceph-devel@vger.kernel.org Subject: [PATCH] libceph: fall back to sendmsg for slab pages Date: Mon, 19 Nov 2018 18:56:45 +0100 Message-Id: <20181119175645.32467-1-idryomov@gmail.com> X-Mailer: git-send-email 2.14.4 Sender: ceph-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: ceph-devel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP skb_can_coalesce() allows coalescing neighboring slab objects into a single frag: return page == skb_frag_page(frag) && off == frag->page_offset + skb_frag_size(frag); ceph_tcp_sendpage() can be handed slab pages. One example of this is XFS: it passes down sector sized slab objects for its metadata I/O. If the kernel client is co-located on the OSD node, the skb may go through loopback and pop on the receive side with the exact same set of frags. When tcp_recvmsg() attempts to copy out such a frag, hardened usercopy complains because the size exceeds the object's allocated size: usercopy: kernel memory exposure attempt detected from ffff9ba917f20a00 (kmalloc-512) (1024 bytes) Although skb_can_coalesce() could be taught to return false if the resulting frag would cross a slab object boundary, we already have a fallback for non-refcounted pages. Utilize it for slab pages too. Cc: stable@vger.kernel.org # 4.8+ Signed-off-by: Ilya Dryomov --- net/ceph/messenger.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c index 57fcc6b4bf6e..2f126eff275d 100644 --- a/net/ceph/messenger.c +++ b/net/ceph/messenger.c @@ -580,9 +580,15 @@ static int ceph_tcp_sendpage(struct socket *sock, struct page *page, struct bio_vec bvec; int ret; - /* sendpage cannot properly handle pages with page_count == 0, - * we need to fallback to sendmsg if that's the case */ - if (page_count(page) >= 1) + /* + * sendpage cannot properly handle pages with page_count == 0, + * we need to fall back to sendmsg if that's the case. + * + * Same goes for slab pages: skb_can_coalesce() allows + * coalescing neighboring slab objects into a single frag which + * triggers one of hardened usercopy checks. + */ + if (page_count(page) >= 1 && !PageSlab(page)) return __ceph_tcp_sendpage(sock, page, offset, size, more); bvec.bv_page = page;