netdev - Re: [net 1/1] tipc: Unclone message at secondary destination lookup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Sun, 08 Oct 2017 21:13:53 -0700 (PDT)
From:   David Miller <davem@...emloft.net>
To:     jon.maloy@...csson.com
Cc:     netdev@...r.kernel.org, parthasarathy.bhuvaragan@...csson.com,
        ying.xue@...driver.com, tipc-discussion@...ts.sourceforge.net
Subject: Re: [net 1/1] tipc: Unclone message at secondary destination lookup

From: Jon Maloy <jon.maloy@...csson.com>
Date: Sat, 7 Oct 2017 15:07:20 +0200

> When a bundling message is received, the function tipc_link_input()
> calls function tipc_msg_extract() to unbundle all inner messages of
> the bundling message before adding them to input queue.
> 
> The function tipc_msg_extract() just clones all inner skb for all
> inner messagges from the bundling skb. This means that the skb
> headroom of an inner message overlaps with the data part of the
> preceding message in the bundle.
> 
> If the message in question is a name addressed message, it may be
> subject to a secondary destination lookup, and eventually be sent out
> on one of the interfaces again. But, since what is perceived as headroom
> by the device driver in reality is the last bytes of the preceding
> message in the bundle, the latter will be overwritten by the MAC
> addresses of the L2 header. If the preceding message has not yet been
> consumed by the user, it will evenually be delivered with corrupted
> contents.
> 
> This commit fixes this by uncloning all messages passing through the
> function tipc_msg_lookup_dest(), hence ensuring that the headroom
> is always valid when the message is passed on.
> 
> Signed-off-by: Tung Nguyen <tung.q.nguyen@...tech.com.au>
> Signed-off-by: Jon Maloy <jon.maloy@...csson.com>

Applied.