linux-kernel - skb_over_panic using UDP and 6lowpan / fakelb

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <56012235-e1d0-1e5e-840a-cc8d5938c380@ntnu.no>
Date:   Mon, 27 Mar 2017 11:16:47 +0200
From:   David Palma <david.palma@...u.no>
To:     linux-kernel@...r.kernel.org
Subject: skb_over_panic using UDP and 6lowpan / fakelb

Hi,

Sending a simple UDP packet (39 bytes long), over a 6lowpan interface
(using fakelb), creates a kernel panic (skb_over_panic).

Steps to reproduce, and more details, can be found in:
https://github.com/PalmaITEM/6lowpan-skb_over_panic

This bug has been reported in
https://bugzilla.kernel.org/show_bug.cgi?id=195059

I have found that lengths around 39 bytes can also trigger this
behaviour and that longer packets are handled without problem.

Verified in:

- Linux version 4.9.0-0.bpo.2-amd64 (debian-kernel@...ts.debian.org)
(gcc version 4.9.2 (Debian 4.9.2-10) ) #1 SMP Debian 4.9.13-1~bpo8+1
(2017-02-27)
- Linux version 4.10.4-1-ARCH (builduser@...ias) (gcc version 6.3.1
20170306 (GCC) ) #1 SMP PREEMPT Sat Mar 18 19:39:18 CET 2017

I am not familiar with the process of reporting kernel bugs, so
apologies beforehand. I am also available to provide any missing
information.

Cheers,
-- 
David Palma

Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)