lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Mon, 18 Feb 2019 14:44:05 +0100 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-kernel@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>, stable@...r.kernel.org, syzbot+9d7405c7faa390e60b4e@...kaller.appspotmail.com, syzbot+7d20bc3f1ddddc0f9079@...kaller.appspotmail.com, Sven Eckelmann <sven@...fation.org>, Simon Wunderlich <sw@...onwunderlich.de> Subject: [PATCH 4.4 117/143] batman-adv: Force mac header to start of data on xmit 4.4-stable review patch. If anyone has any objections, please let me know. ------------------ From: Sven Eckelmann <sven@...fation.org> commit 9114daa825fc3f335f9bea3313ce667090187280 upstream. The caller of ndo_start_xmit may not already have called skb_reset_mac_header. The returned value of skb_mac_header/eth_hdr therefore can be in the wrong position and even outside the current skbuff. This for example happens when the user binds to the device using a PF_PACKET-SOCK_RAW with enabled qdisc-bypass: int opt = 4; setsockopt(sock, SOL_PACKET, PACKET_QDISC_BYPASS, &opt, sizeof(opt)); Since eth_hdr is used all over the codebase, the batadv_interface_tx function must always take care of resetting it. Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol") Reported-by: syzbot+9d7405c7faa390e60b4e@...kaller.appspotmail.com Reported-by: syzbot+7d20bc3f1ddddc0f9079@...kaller.appspotmail.com Signed-off-by: Sven Eckelmann <sven@...fation.org> Signed-off-by: Simon Wunderlich <sw@...onwunderlich.de> Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org> --- net/batman-adv/soft-interface.c | 2 ++ 1 file changed, 2 insertions(+) --- a/net/batman-adv/soft-interface.c +++ b/net/batman-adv/soft-interface.c @@ -209,6 +209,8 @@ static int batadv_interface_tx(struct sk soft_iface->trans_start = jiffies; vid = batadv_get_vid(skb, 0); + + skb_reset_mac_header(skb); ethhdr = eth_hdr(skb); switch (ntohs(ethhdr->h_proto)) {
Powered by blists - more mailing lists