linux-kernel - Re: [PATCH] net: Reset skb to network header in neigh_hh

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <1477501711.7065.198.camel@edumazet-glaptop3.roam.corp.google.com>
Date:   Wed, 26 Oct 2016 10:08:31 -0700
From:   Eric Dumazet <eric.dumazet@...il.com>
To:     Abdelrhman Ahmed <ab@...hmed.com>
Cc:     davem <davem@...emloft.net>, netdev <netdev@...r.kernel.org>,
        linux-kernel <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] net: Reset skb to network header in neigh_hh_output

On Wed, 2016-10-26 at 18:53 +0200, Abdelrhman Ahmed wrote:
> I think it's at the right place as the current one is a little different from the
> commit e1f165032c8bade3a6bdf546f8faf61fda4dd01c.
> 
> In the next lines, skb_push is called after copying the hardware header and there
> is no change to the data pointer inside the retry loop. We only need to reset
> before this loop.
> 
> __skb_pull(skb, skb_network_offset(skb));
> 
> do {
> 	seq = read_seqbegin(&hh->hh_lock);
> 	hh_len = hh->hh_len;
> 	if (likely(hh_len <= HH_DATA_MOD)) {
> 		/* this is inlined by gcc */
> 		memcpy(skb->data - HH_DATA_MOD, hh->hh_data, HH_DATA_MOD);
> 	} else {
> 		int hh_alen = HH_DATA_ALIGN(hh_len);
> 
> 		memcpy(skb->data - hh_alen, hh->hh_data, hh_alen);
> 	}
> } while (read_seqretry(&hh->hh_lock, seq));
> 
> skb_push(skb, hh_len);
> 
> In the commit e1f165032c8bade3a6bdf546f8faf61fda4dd01c, dev_hard_header which
> calls create method for adding hardware header (uses skb_push) so it was
> required to reset to network header in the beginning of the retry loop.

Right you are, thanks for the clarification !

Back to the cause of the bug then.

If netfilter is the only case this might be needed, can't this be fixed
in netfilter ?

neigh_hh_output() is in fast path, it is quite annoying adding this
operation.