netdev - RE: [RFC v3 2/2] iwlwifi: mvm: send large SKBs to the transport

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Thu, 22 Oct 2015 12:07:59 +0000
From:	"Grumbach, Emmanuel" <emmanuel.grumbach@...el.com>
To:	Eric Dumazet <eric.dumazet@...il.com>
CC:	"linux-wireless@...r.kernel.org" <linux-wireless@...r.kernel.org>,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>,
	"Sharon, Sara" <sara.sharon@...el.com>,
	"ido@...ery.com" <ido@...ery.com>
Subject: RE: [RFC v3 2/2] iwlwifi: mvm: send large SKBs to the transport

> 
> On Wed, 2015-10-21 at 21:34 +0300, Emmanuel Grumbach wrote:
> > +
> > +		if (skb->protocol == htons(ETH_P_IP)) {
> > +			ip_hdr(tmp)->id = ip_hdr(skb)->id;
> 
> Too late, you already called consume_skb(skb).
> So this is a potential use after free.

Ouch - thanks for catching this!

> 
> > +			be16_add_cpu(&ip_hdr(tmp)->id, i *
> num_subframes);
> > +		}
> > +
> 
> 
> I would use
> base_id = ip_hdr(skb)->id; // before the consume_skb(skb)
> ip_hdr(tmp)->id = htons(base_id + i * num_subframes);
> 
Sure - I will.

I will send a v4 with the fixes.