netdev - Re: Bridge + Conntrack + SKB Recycle: Fragment Reassembly Errors

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sat, 21 Nov 2009 11:08:32 -0800 (PST)
From:	David Miller <davem@...emloft.net>
To:	kaber@...sh.net
Cc:	ben@...footnetworks.com, netdev@...r.kernel.org
Subject: Re: Bridge + Conntrack + SKB Recycle: Fragment Reassembly Errors

From: Patrick McHardy <kaber@...sh.net>
Date: Tue, 10 Nov 2009 17:50:38 +0100

> This code in ip_fragment() looks suspicious:
> 
> 	if (skb_has_frags(skb)) {
> 	...
> 		skb_walk_frags(skb, frag) {
> 			...
> 			if (skb->sk) {
> 				frag->sk = skb->sk;
> 				frag->destructor = sock_wfree;
> 				truesizes += frag->truesize;
> 			}
> 
> truesizes is later used to adjust truesize of the head skb.
> For some reason this is only done when it originated from a
> local socket.

Well, it shouldn't look _that_ suspicious.

What this code is doing is making sure that after we make all of these
changes, the truesize of the SKBs referrng to the socket do not
change.

It's simply making sure that the math works out when all the
sock_wfree() calls occur later.

If we don't have a socket involved, there is no reason to make
these adjustments.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html