lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue, 20 Dec 2022 15:12:07 +0200 From: Tudor Ambarus <tudor.ambarus@...aro.org> To: mst@...hat.com, jasowang@...hat.com, virtualization@...ts.linux-foundation.org, edumazet@...gle.com, davem@...emloft.net, kuba@...nel.org, pabeni@...hat.com, netdev@...r.kernel.org, willemb@...gle.com, syzkaller@...glegroups.com, liuhangbin@...il.com Cc: linux-kernel@...r.kernel.org, joneslee@...gle.com Subject: kernel BUG in __skb_gso_segment Hi, There's a bug [1] reported by syzkaller in linux-5.15.y that I'd like to squash. The commit in stable that introduces the bug is: b99c71f90978 net: skip virtio_net_hdr_set_proto if protocol already set The upstream commit for this is: 1ed1d592113959f00cc552c3b9f47ca2d157768f I discovered that in mainline this bug was squashed by the following commits: e9d3f80935b6 ("net/af_packet: make sure to pull mac header") dfed913e8b55 ("net/af_packet: add VLAN support for AF_PACKET SOCK_RAW GSO") I'm seeking for some guidance on how to fix linux-5.15.y. From what I understand, the bug in stable is triggered because we end up with a header offset of 18, that eventually triggers the GSO crash in __skb_pull. If I revert the commit in culprit from linux-5.15.y, we'll end up with a header offset of 14, the bug is not hit and the packet is dropped at validate_xmit_skb() time. I'm wondering if reverting it is the right thing to do, as the commit is marked as a fix. Backporting the 2 commits from mainline is not an option as they introduce new support. Would such a patch be better than reverting the offending commit? diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h index a960de68ac69..188b6f05e5bd 100644 --- a/include/linux/virtio_net.h +++ b/include/linux/virtio_net.h @@ -25,7 +25,7 @@ static inline bool virtio_net_hdr_match_proto(__be16 protocol, __u8 gso_type) static inline int virtio_net_hdr_set_proto(struct sk_buff *skb, const struct virtio_net_hdr *hdr) { - if (skb->protocol) + if (skb->protocol && skb->protocol != htons(ETH_P_ALL)) return 0; switch (hdr->gso_type & ~VIRTIO_NET_HDR_GSO_ECN) { Thanks! ta [1] https://syzkaller.appspot.com/bug?id=ce5575575f074c33ff80d104f5baee26f22e95f5
Powered by blists - more mailing lists