linux-kernel - Re: [BUG] net: core: netif_receive_skb_list() crash on non-standard ptypes forwarding

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <3a31d5c9-6995-7078-1644-d170f70992f9@solarflare.com>
Date:   Thu, 28 Mar 2019 12:29:35 +0000
From:   Edward Cree <ecree@...arflare.com>
To:     Alexander Lobakin <alobakin@...nk.ru>
CC:     "David S. Miller" <davem@...emloft.net>,
        Jiri Pirko <jiri@...lanox.com>,
        Ido Schimmel <idosch@...lanox.com>,
        Petr Machata <petrm@...lanox.com>,
        Alexander Duyck <alexander.h.duyck@...el.com>,
        Amritha Nambiar <amritha.nambiar@...el.com>,
        Li RongQing <lirongqing@...du.com>, <netdev@...r.kernel.org>,
        <linux-kernel@...r.kernel.org>
Subject: Re: [BUG] net: core: netif_receive_skb_list() crash on non-standard
 ptypes forwarding

On 28/03/2019 11:56, Alexander Lobakin wrote:
> Edward Cree wrote 28.03.2019 14:37:
>> On 28/03/2019 10:03, Alexander Lobakin wrote:
>>> Here's a working possible fix for that, not sure if it can break anything
>>> though.
>>>
>>> diff --git a/net/core/dev.c b/net/core/dev.c
>>> index 2b67f2aa59dd..fdcff29df915 100644
>>> --- a/net/core/dev.c
>>> +++ b/net/core/dev.c
>>> @@ -5014,8 +5014,10 @@ static inline void __netif_receive_skb_list_ptype(struct list_head *head,
>>>     if (pt_prev->list_func != NULL)
>>>         pt_prev->list_func(head, pt_prev, orig_dev);
>>>     else
>>> -        list_for_each_entry_safe(skb, next, head, list)
>>> +        list_for_each_entry_safe(skb, next, head, list) {
>>> +            skb_list_del_init(skb);
>>>             pt_prev->func(skb, skb->dev, pt_prev, orig_dev);
>>> +        }
>>> }
>>>
>>> static void __netif_receive_skb_list_core(struct list_head *head, bool pfmemalloc)
>>>
>>> Maybe you could look into this and find another/better solution (or I could
>>> submit this one if that's pretty enough).
>> That looks like the correct fix to me, go ahead and have a
>> Reviewed-by: Edward Cree <ecree@...arflare.com>
>
> Cool!
> Do we need a "stable" mark in this case to propose it to LTS backports (4.20+, I suppose)?
Probably add a
Fixes: 88eb1944e18c ("net: core: propagate SKB lists through packet_type lookup")
(then Dave will take care of sending it to -stable.)

-Ed