netdev - Re: ipv6: fix headroom calculation in udp6_ufo

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 13 Dec 2013 14:34:53 +0100
From:	Hannes Frederic Sowa <hannes@...essinduktion.org>
To:	Mark Hambleton <mark.hambleton@...adcom.com>
Cc:	'Pravin B Shelar' <pshelar@...ira.com>,
	'Saran Neti' <Saran.Neti@...us.com>,
	"'David S. Miller'" <davem@...emloft.net>,
	'Greg Kroah-Hartman' <gregkh@...uxfoundation.org>,
	"Mark Brown (broonie@...aro.org)" <broonie@...aro.org>,
	"'netdev@...r.kernel.org'" <netdev@...r.kernel.org>,
	"'stable@...r.kernel.org'" <stable@...r.kernel.org>
Subject: Re: ipv6: fix headroom calculation in udp6_ufo_fragment

On Fri, Dec 13, 2013 at 01:01:59PM +0000, Mark Hambleton wrote:
> Hi, 
> 
> Following a recent commit to LTS and upstream  I see the following warning emitted on an ARM32 build:
> 
> net/ipv6/udp_offload.c: In function 'udp6_ufo_fragment':
> net/ipv6/udp_offload.c:88:22: error: comparison between pointer and integer [-Werror]
>   if (skb->mac_header < (tnl_hlen + frag_hdr_sz)) {
>                       ^
> cc1: all warnings being treated as errors
> make[2]: *** [net/ipv6/udp_offload.o] Error 1
> make[1]: *** [net/ipv6] Error 2
> 
>  The commit made the following changes:
> 
> -       if (skb_headroom(skb) < (tnl_hlen + frag_hdr_sz)) {
> +       if (skb->mac_header < (tnl_hlen + frag_hdr_sz)) {
> 
> Now, because of some defines in skbuff.h :
> 
> #if BITS_PER_LONG > 32
> #define NET_SKBUFF_DATA_USES_OFFSET 1
> #endif
> 
> #ifdef NET_SKBUFF_DATA_USES_OFFSET
> typedef unsigned int sk_buff_data_t;
> #else
> typedef unsigned char *sk_buff_data_t;
> #endif
> 
> On an ARM32 system sk_buff_data_t would be a pointer (long being 32 bits), meaning that skb->mac_header is a pointer and that  you are comparing a pointer against a length, which doesn't look like it is correct to me?
> 
> I can see how this works when NET_SKBUFF_DATA_USES_OFFSET is defined, but is there a way to do this that works for both cases?

Sorry, I don't know which version the LTS kernel is. Upstream does not use
sk_buff_data_t for mac_header any more.

Something like that might help:

(skb_mac_header(skb) < skb->head + tnl_hlen + frag_hdr_sz)

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html