lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Fri, 1 Nov 2013 09:45:29 +0100 From: Steffen Klassert <steffen.klassert@...unet.com> To: Patrick McHardy <kaber@...sh.net> Cc: Tomas Hlavacek <tmshlvck@...il.com>, netdev@...r.kernel.org, netfilter-devel@...r.kernel.org Subject: Re: ipv6 fragmentation-related panic in netfilter On Wed, Oct 30, 2013 at 12:07:11AM +0000, Patrick McHardy wrote: > > The problem is that the reassembled packet is referenced by the individual > fragments, so we trigger the BUG_ON in pskb_expand_head(). In this > particular case the case we BUG() on is actually OK, but I'm looking at > a way we can fix this without special casing. Hope to have a patch for > testing in the next hours. Just for the record. I'm observing similar, quite reproducable crashes when receiving fragmented icmp echo request packets on an IPsec gateway with nf_conntrack_ipv6. Since git commit 58a317f10 ("netfilter: ipv6: add IPv6 NAT support") netfilter might insert a reassembled ipv6 packet with a shared skb and local_df = 1 to the ok function. In case of xfrm, __xfrm6_output() fragments the packet again and when adjusting the headroom later, we crash because of a shared skb. I can fix it by checking for a shared skb in ip6_fragment() and do slow path fragmentation then. But we never needed such a check in ip6_fragment(), so it's maybe better to fix it in netfilter. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists