linux-kernel - Re: kernel >= 4.0: crashes when using traceroute6 with isatap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1431462991.566.97.camel@edumazet-glaptop2.roam.corp.google.com>
Date:	Tue, 12 May 2015 13:36:31 -0700
From:	Eric Dumazet <eric.dumazet@...il.com>
To:	Vlad Yasevich <vyasevich@...il.com>
Cc:	Wolfgang Walter <linux@...m.de>,
	Cong Wang <xiyou.wangcong@...il.com>,
	LKML <linux-kernel@...r.kernel.org>,
	Hannes Frederic Sowa <hannes@...essinduktion.org>,
	Linux Kernel Network Developers <netdev@...r.kernel.org>
Subject: Re: kernel >= 4.0: crashes when using traceroute6 with isatap

On Tue, 2015-05-12 at 16:18 -0400, Vlad Yasevich wrote:
> On 05/06/2015 06:11 PM, Wolfgang Walter wrote:
> > Am Mittwoch, 6. Mai 2015, 11:15:18 schrieben Sie:
> >> (Cc'ing netdev.)
> >>
> >> On Sat, May 2, 2015 at 5:29 AM, Wolfgang Walter <linux@...m.de> wrote:
> >>> Am Samstag, 2. Mai 2015, 02:16:36 schrieb Wolfgang Walter:
> >>>> Hello,
> >>>>
> >>>> kernel 4.0 (and 4.0.1) crashes immediately when I use traceroute6 with an
> >>>> isatap-tunnel.
> >>>
> >>> I did some further tests. To trigger the crash you need
> >>>
> >>> * isatap-tunnel (probably any sit-tunnel will do it)
> >>> * raw-socket
> >>> * udp
> >>>
> >>> Using icmpv6 or tcp i.e. does not trigger it.
> >>
> >> Do you have a script to reproduce it?
> >>
> >>
> >> Thanks for the bug report!
> >
> > You need a isatap-server with say ipv4-address $X
> >
> > Then, on host with 4.0, start isatapd: isatapd --mtu 1280 $X
> >
> > then do
> >
> > 	traceroute6 www.google.de
> >
> > Regards,
> >
> 
> Hi Walter
> 
> Could you try this patch.  Looks like raw passes transhdrlen
> of 0 on the first packet and that makes IPv4 behave correctly,
> but not IPv6.
> 
> 
> diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
> index 7fde1f2..fd9c079 100644
> --- a/net/ipv6/ip6_output.c
> +++ b/net/ipv6/ip6_output.c
> @@ -1278,7 +1278,7 @@ emsgsize:
>  	/* If this is the first and only packet and device
>  	 * supports checksum offloading, let's use it.
>  	 */
> -	if (!skb && sk->sk_protocol == IPPROTO_UDP &&
> +	if (transhdrlen && sk->sk_protocol == IPPROTO_UDP &&
>  	    length + fragheaderlen < mtu &&
>  	    rt->dst.dev->features & NETIF_F_V6_CSUM &&
>  	    !exthdrlen)

And make sure the checksum is correct ;)

Vlad, can you tell where skb->cum_start and skb->csum_offset are set ?



--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/