linux-kernel - Re: [OOPS] In __netif_receive_skb

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1452608377.1223.13.camel@edumazet-glaptop2.roam.corp.google.com>
Date:	Tue, 12 Jan 2016 06:19:37 -0800
From:	Eric Dumazet <eric.dumazet@...il.com>
To:	Ivaylo Dimitrov <ivo.g.dimitrov.75@...il.com>
Cc:	Salam Noureddine <noureddine@...sta.com>,
	"David S. Miller" <davem@...emloft.net>,
	Pali Rohár <pali.rohar@...il.com>,
	Network Development <netdev@...r.kernel.org>,
	LKML <linux-kernel@...r.kernel.org>,
	Sebastian Reichel <sre@...nel.org>,
	"linux-omap@...r.kernel.org" <linux-omap@...r.kernel.org>
Subject: Re: [OOPS] In __netif_receive_skb_core

On Tue, 2016-01-12 at 09:16 +0200, Ivaylo Dimitrov wrote:
> 
> On 12.01.2016 04:25, Eric Dumazet wrote:

> >
> > OK please try this fix :
> >
> > diff --git a/net/phonet/af_phonet.c b/net/phonet/af_phonet.c
> > index 10d42f3220ab..f925753668a7 100644
> > --- a/net/phonet/af_phonet.c
> > +++ b/net/phonet/af_phonet.c
> > @@ -377,6 +377,10 @@ static int phonet_rcv(struct sk_buff *skb, struct net_device *dev,
> >   	struct sockaddr_pn sa;
> >   	u16 len;
> >
> > +	skb = skb_share_check(skb, GFP_ATOMIC);
> > +	if (!skb)
> > +		return NET_RX_DROP;
> > +
> >   	/* check we have at least a full Phonet header */
> >   	if (!pskb_pull(skb, sizeof(struct phonethdr)))
> >   		goto out;
> >
> >
> 
> That one fixes the oops, though I wonder if your previous patch is 
> needed (I reverted it before testing the current). Unfortunately I don't 
> have SIM card around to test GPRS connection with, will do it as soon as 
> I find one and will report.

Well, this bug in phonet_rcv() is rather obvious, I have no idea why
nobody got crashes or corruptions before today.

I'll send a formal patch.

Thanks for your help !