netdev - Re: [PATCH net] net: ipv6: ip6_output: alloc skb with tailroom

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 06 Jun 2018 13:53:39 -0400 (EDT)
From:   David Miller <davem@...emloft.net>
To:     aring@...atatu.com
Cc:     netdev@...r.kernel.org, yoshfuji@...ux-ipv6.org,
        david.palma@...u.no, rabinarayans0828@...il.com, jhs@...atatu.com,
        stefan@....samsung.com, linux-wpan@...r.kernel.org,
        kernel@...atatu.com
Subject: Re: [PATCH net] net: ipv6: ip6_output: alloc skb with tailroom

From: Alexander Aring <aring@...atatu.com>
Date: Tue,  5 Jun 2018 18:04:04 -0400

> This patch adds care about tailroom length for allocate a skb from ipv6
> level stack. In case of 6lowpan we had the problem the skb runs into a
> skb_over_panic() in some special length cases. The root was there was no
> tailroom allocated for the IEEE 802.15.4 checksum, although we had
> the necessary tailroom specified inside the netdev structure.
> 
> Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=195059
> Reported-by: David Palma <david.palma@...u.no>
> Reported-by: Rabi Narayan Sahoo <rabinarayans0828@...il.com>
> Signed-off-by: Alexander Aring <aring@...atatu.com>

needed_tailroom is an optimization to avoid SKB reallocations
and adjustments, it is not a guarantee.

If you are seeing crashes, it means code is assuming something which
is not to be assumed.

Whatever code is involved, it needs to check that the necessary
tailroom is there and reallocate if necessary, rather than
blindly pushing past the end of the SKB data.