netdev - Re: Bug in computing data_len in tcp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 01 Dec 2011 13:04:03 -0500 (EST)
From:	David Miller <davem@...emloft.net>
To:	jesse.brandeburg@...el.com
Cc:	eric.dumazet@...il.com, therbert@...gle.com,
	netdev@...r.kernel.org, alexander.h.duyck@...el.com
Subject: Re: Bug in computing data_len in tcp_sendmsg?

From: Jesse Brandeburg <jesse.brandeburg@...el.com>
Date: Thu, 1 Dec 2011 09:29:50 -0800

> Tom, thanks very much for finding this subtle bug!  I bet that this
> commit (which I had missed) broke a lot of other drivers in
> very subtle ways due to changing a long standing behavior.

I call bullshit on this.

It's always been possible, any entity between the TCP stack and your
driver can pull data from the segmented pages into the linear data
area.

F.e. netfilter, packet scheduler actions, you name it.

This code sequence has always been buggy.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html