linux-kernel - Re: GKI: [kernel6.1] Kernel panic on __udpv4_gso_segment_list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Fri, 27 Oct 2023 09:54:49 +0000
From:   Lena Wang (王娜) <Lena.Wang@...iatek.com>
To:     "pabeni@...hat.com" <pabeni@...hat.com>
CC:     "cmllamas@...gle.com" <cmllamas@...gle.com>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "eric.dumazet@...il.com" <eric.dumazet@...il.com>,
        "maze@...gle.com" <maze@...gle.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: GKI: [kernel6.1] Kernel panic on __udpv4_gso_segment_list_csum in
 rx-udp-gro-forwarding

On Fri, 2023-10-27 at 11:12 +0200, Paolo Abeni wrote:
>  	 
> External email : Please do not click links or open attachments until
> you have verified the sender or the content.
>  On Fri, 2023-10-27 at 08:17 +0000, Lena Wang (王娜) wrote:
> > Sorry. I don't use netdev ML before. I do have a google partner
> account
> > lena.wang@...iatek.corp-partner.google.com, it is justed used to
> report
> > Google bug and don't know how to send a email. I try to use text
> formal
> > to reply mail.
> 
> I'm sorry if the following can sound not very polite, but really you
> have to move this conversation on the netdev ML or to the google
> support.
> 
> Cheers,
> 
> Paolo
> 
Hi Paolo,
Sorry, I add the netdev in cc and if it is on netdev ML. 
==========================
I have merged your patch in the load and the kernel panic happens with
your patch.  The crashed skb with cloned = 0 and users = 2. I am afraid
the patch doesn't work because the shared skb is not checked.

I am not sure if you could submit your previous patch with:
 +       if (WARN_ON_ONCE(skb_shared(skb))) {
 +               skb =
skb_share_check(skb, GFP_ATOMIC);
 +               if (!skb)

+                       goto err_linearize;
 +       }



 diff --git a/net/core/skbuff.c b/net/core/skbuff.c
 index cea28d30abb5..1b2394ebaf33 100644
 --- a/net/core/skbuff.c
 +++ b/net/core/skbuff.c
 @@ -4270,6 +4270,17 @@ struct sk_buff *skb_segment_list(struct sk_buff
*skb,

         skb_push(skb, -skb_network_offset(skb) + offset);