linux-kernel - Re: PROBLEM: System call 'sendmsg' of process ospfd (quagga) causes kernel oops

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 18 Oct 2011 12:01:33 +0200
From:	Eric Dumazet <eric.dumazet@...il.com>
To:	Herbert Xu <herbert@...dor.apana.org.au>
Cc:	Elmar Vonlanthen <evonlanthen@...il.com>,
	linux-kernel@...r.kernel.org, netdev <netdev@...r.kernel.org>,
	Timo Teräs <timo.teras@....fi>
Subject: Re: PROBLEM: System call 'sendmsg' of process ospfd (quagga) causes
 kernel oops

Le mardi 18 octobre 2011 à 11:34 +0200, Herbert Xu a écrit :
> On Tue, Oct 18, 2011 at 04:30:32AM +0200, Eric Dumazet wrote:
> >
> > If David/Herbert/Timo agree, then patch should find its way into current
> > kernel, then to stable trees as well.
> 
> Actually, I think we should instead fix the users of needed_headroom
> to not read it twice which is causing problems here.
> 
> GRE tunnels by their nature do not have a fixed value for
> needed_headroom.  As the underlying routes change the necessary
> headroom may need to be adjusted due to further encapsulation such
> as IPsec.
> 
> Keeping it constant from tunnel creation may result in suboptimal
> performance due to unnecessary header reallocations.
> 
> However, until we audit the stack to see if there are further
> instances of double-readings such as the one causing the crash
> here, I'm fine with your patch making it constant.
> 
> Once we're sure that all of the double-readings are gone we
> can revert to a dynamic needed_headroom.
> 

Sure, we can work on this path for future kernels.

Adding an RCU protected structure to hold hard_header_len /
needed_headroom / needed_tailroom should be possible, but this adds yet
another pointer dereference...

Thanks !


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/