linux-kernel - Re: [PATCH] net: core: netif_receive_skb_list: unlist skb before passing to pt->func

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20190328.172828.880898031515380835.davem@davemloft.net>
Date:   Thu, 28 Mar 2019 17:28:28 -0700 (PDT)
From:   David Miller <davem@...emloft.net>
To:     alobakin@...nk.ru
Cc:     ecree@...arflare.com, jiri@...lanox.com, idosch@...lanox.com,
        petrm@...lanox.com, alexander.h.duyck@...el.com,
        amritha.nambiar@...el.com, lirongqing@...du.com,
        netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] net: core: netif_receive_skb_list: unlist skb before
 passing to pt->func

From: Alexander Lobakin <alobakin@...nk.ru>
Date: Thu, 28 Mar 2019 18:23:04 +0300

> __netif_receive_skb_list_ptype() leaves skb->next poisoned before passing
> it to pt_prev->func handler, what may produce (in certain cases, e.g. DSA
> setup) crashes like:
 ...
> Fix this by pulling skb off the sublist and zeroing skb->next pointer
> before calling ptype callback.
> 
> Fixes: 88eb1944e18c ("net: core: propagate SKB lists through packet_type lookup")
> Reviewed-by: Edward Cree <ecree@...arflare.com>
> Signed-off-by: Alexander Lobakin <alobakin@...nk.ru>

Applied and queued up for -stable, thanks.