netdev - Re: regression caused by 1d2024f61ec14bdb0c57a97a3fe73685abc2d198?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 06 Feb 2013 05:07:39 -0800
From:	Eric Dumazet <eric.dumazet@...il.com>
To:	"Michael S. Tsirkin" <mst@...hat.com>
Cc:	alexander.h.duyck@...el.com, stephen.s.ko@...el.com,
	jeffrey.t.kirsher@...el.com, David Miller <davem@...emloft.net>,
	netdev@...r.kernel.org
Subject: Re: regression caused by 1d2024f61ec14bdb0c57a97a3fe73685abc2d198?

On Wed, 2013-02-06 at 13:43 +0200, Michael S. Tsirkin wrote:
> It seems that starting with kernel 3.3 ixgbe sets gso_size for
> incoming frames. It seems that this might result in gso_size
> being set even when gso_type is 0.
> This in turn leads to a crash at macvtap_skb_to_vnet_hdr
> drivers/net/macvtap.c:628
> which has this code:
> 
>        if (skb_is_gso(skb)) {
>                 struct skb_shared_info *sinfo = skb_shinfo(skb);
> 
>                 /* This is a hint as to how much should be linear. */
>                 vnet_hdr->hdr_len = skb_headlen(skb);
>                 vnet_hdr->gso_size = sinfo->gso_size;
>                 if (sinfo->gso_type & SKB_GSO_TCPV4)
>                         vnet_hdr->gso_type = VIRTIO_NET_HDR_GSO_TCPV4;
>                 else if (sinfo->gso_type & SKB_GSO_TCPV6)
>                         vnet_hdr->gso_type = VIRTIO_NET_HDR_GSO_TCPV6;
>                 else if (sinfo->gso_type & SKB_GSO_UDP)
>                         vnet_hdr->gso_type = VIRTIO_NET_HDR_GSO_UDP;
>                 else
>                         BUG();
>                 if (sinfo->gso_type & SKB_GSO_TCP_ECN)
>                         vnet_hdr->gso_type |= VIRTIO_NET_HDR_GSO_ECN;
>         } else
>                 vnet_hdr->gso_type = VIRTIO_NET_HDR_GSO_NONE;
> 
> 
> Since skb_is_gso tests gso_size.
> 
> What's the right way to handle this? Should skb_is_gso be
> changed to test gso_type != 0?
> 

Or fix ixgbe to set gso_type in ixgbe_get_headlen(), as it does all the
dissection.




--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html