linux-kernel - Re: v4.16-rc1 misaligned atomics in skb__clone / __napi_alloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CANn89iLvNjvUsjsqVN=3ZTPQvp6xChqYEu+cUASFXtTSQnA1aA@mail.gmail.com>
Date:   Thu, 15 Feb 2018 09:24:36 -0800
From:   Eric Dumazet <edumazet@...gle.com>
To:     Mark Rutland <mark.rutland@....com>
Cc:     netdev <netdev@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>,
        David Miller <davem@...emloft.net>,
        Willem de Bruijn <willemb@...gle.com>
Subject: Re: v4.16-rc1 misaligned atomics in skb__clone / __napi_alloc_skb

On Thu, Feb 15, 2018 at 9:20 AM, Eric Dumazet <edumazet@...gle.com> wrote:
>
> Yes, it seems tun.c breaks the assumptions.
>
> If it really wants to provide arbitrary fragments and alignments, it
> should use a separate

Sorry, I have sent the message to soon.

tun.c should use a private 'struct page_frag_cache' to deliver
arbitrary frags/alignments,
so that syzkaller might catch interesting bugs in the stack.


>
> Please try :
>
> diff --git a/drivers/net/tun.c b/drivers/net/tun.c
> index 81e6cc951e7fc7c983919365c34842c34bcaedcf..92c6b6d02f7c18b63c42ffe1d9cb7286975e1263
> 100644
> --- a/drivers/net/tun.c
> +++ b/drivers/net/tun.c
> @@ -1500,7 +1500,7 @@ static struct sk_buff
> *tun_napi_alloc_frags(struct tun_file *tfile,
>                 }
>
>                 local_bh_disable();
> -               data = napi_alloc_frag(fragsz);
> +               data = napi_alloc_frag(SKB_DATA_ALIGN(fragsz));
>                 local_bh_enable();
>                 if (!data) {
>                         err = -ENOMEM;

This patch should solve your immediate problem, but would lower fuzzer
abilities to find bugs.

I will send something more suited to original intent of these commits :

90e33d45940793def6f773b2d528e9f3c84ffdc7 tun: enable napi_gro_frags()
for TUN/TAP driver
943170998b200190f99d3fe7e771437e2c51f319 tun: enable NAPI for TUN/TAP driver