netdev - RE: [PATCH] net: fix skb_seq_read returning wrong offset/length for page frag data

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 18 May 2009 18:32:29 +0530
From:	<Shyam_Iyer@...l.com>
To:	<Thomas_Chenault@...l.com>, <netdev@...r.kernel.org>
Cc:	<michaelc@...wisc.edu>, <davem@...emloft.net>
Subject: RE: [PATCH] net: fix skb_seq_read returning wrong offset/length for page frag data

> -----Original Message-----
> From: Chenault, Thomas
> Sent: Thursday, May 14, 2009 7:03 AM
> To: 'netdev@...r.kernel.org'
> Cc: Iyer, Shyam; 'michaelc@...wisc.edu'
> Subject: [PATCH] net: fix skb_seq_read returning wrong offset/length
> for page frag data
> 
> When called with a consumed value that is less than skb_headlen(skb)
> bytes into a page frag, skb_seq_read() incorrectly returns an
> offset/length relative to skb->data. Ensure that data which should
come
> from a page frag does.
> 
> Signed-off-by: Thomas Chenault <thomas_chenault@...l.com>
> 
> diff --git a/net/core/skbuff.c b/net/core/skbuff.c
> index d152394..e505b53 100644
> --- a/net/core/skbuff.c
> +++ b/net/core/skbuff.c
> @@ -2288,7 +2288,7 @@ unsigned int skb_seq_read(unsigned int consumed,
> const u8 **data,
>  next_skb:
>  	block_limit = skb_headlen(st->cur_skb) + st->stepped_offset;
> 
> -	if (abs_offset < block_limit) {
> +	if (abs_offset < block_limit && !st->frag_data) {
>  		*data = st->cur_skb->data + (abs_offset - st-
> >stepped_offset);
>  		return block_limit - abs_offset;
>  	}

Tested-by: Shyam Iyer <shyam_iyer@...l.com>

We have seen this scenario affect iSCSI transactions(mainly login) with
BCM57710 10G Ethernet(bnx2x driver) card.

The iSCSI login errs because the iSCSI PDU header is wrongly read with a
wrong ITT value. This error in reading the PDU is seen with this card
because of the way the bnx2x driver pushes data to the frags with LRO
enabled (through skb->frags[n]).

Intel 10G(ixgbe driver) + LRO combination does not expose the issue and
the patch doesn't cause a regression either. I am not sure if this patch
will break other driver+card configurations.  

Dave - Does this patch needs more review or you want to queue it up to
your tree? I believe it is a critical bug fix.

-Shyam Iyer
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html