lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue, 12 Feb 2013 20:18:13 +0400 From: Pavel Emelyanov <xemul@...allels.com> To: Eric Dumazet <eric.dumazet@...il.com>, David Miller <davem@...emloft.net> CC: Tommi Rantala <tt.rantala@...il.com>, netdev@...r.kernel.org, Dave Jones <davej@...hat.com> Subject: Re: [PATCH] net: fix infinite loop in __skb_recv_datagram() On 02/12/2013 08:16 PM, Eric Dumazet wrote: > From: Eric Dumazet <edumazet@...gle.com> > > Tommi was fuzzing with trinity and reported the following problem : > > commit 3f518bf745 (datagram: Add offset argument to __skb_recv_datagram) > missed that a raw socket receive queue can contain skbs with no payload. > > We can loop in __skb_recv_datagram() with MSG_PEEK mode, because > wait_for_packet() is not prepared to skip these skbs. > > [ 83.541011] INFO: rcu_sched detected stalls on CPUs/tasks: {} > (detected by 0, t=26002 jiffies, g=27673, c=27672, q=75) > [ 83.541011] INFO: Stall ended before state dump start > [ 108.067010] BUG: soft lockup - CPU#0 stuck for 22s! [trinity-child31:2847] > ... > [ 108.067010] Call Trace: > [ 108.067010] [<ffffffff818cc103>] __skb_recv_datagram+0x1a3/0x3b0 > [ 108.067010] [<ffffffff818cc33d>] skb_recv_datagram+0x2d/0x30 > [ 108.067010] [<ffffffff819ed43d>] rawv6_recvmsg+0xad/0x240 > [ 108.067010] [<ffffffff818c4b04>] sock_common_recvmsg+0x34/0x50 > [ 108.067010] [<ffffffff818bc8ec>] sock_recvmsg+0xbc/0xf0 > [ 108.067010] [<ffffffff818bf31e>] sys_recvfrom+0xde/0x150 > [ 108.067010] [<ffffffff81ca4329>] system_call_fastpath+0x16/0x1b > > Reported-by: Tommi Rantala <tt.rantala@...il.com> > Tested-by: Tommi Rantala <tt.rantala@...il.com> > Signed-off-by: Eric Dumazet <edumazet@...gle.com> > Cc: Pavel Emelyanov <xemul@...allels.com> Acked-by: Pavel Emelyanov <xemul@...allels.com> Thanks! > --- > net/core/datagram.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/net/core/datagram.c b/net/core/datagram.c > index 0337e2b..368f9c3 100644 > --- a/net/core/datagram.c > +++ b/net/core/datagram.c > @@ -187,7 +187,7 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags, > skb_queue_walk(queue, skb) { > *peeked = skb->peeked; > if (flags & MSG_PEEK) { > - if (*off >= skb->len) { > + if (*off >= skb->len && skb->len) { > *off -= skb->len; > continue; > } > > > . > -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists