netdev - Re: oops in net/ipv4/icmp.c:icmp_send() with icmp_errors_use_inbound

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20070519.145042.105428414.davem@davemloft.net>
Date:	Sat, 19 May 2007 14:50:42 -0700 (PDT)
From:	David Miller <davem@...emloft.net>
To:	kaber@...sh.net
Cc:	netdev@...r.kernel.org, jmorris@...ei.org, Curtis@...enKey.net
Subject: Re: oops in net/ipv4/icmp.c:icmp_send() with
 icmp_errors_use_inbound_ifaddr (fwd)

From: Patrick McHardy <kaber@...sh.net>
Date: Thu, 17 May 2007 18:52:29 +0200

> [IPV4]: icmp: fix crash with sysctl_icmp_errors_use_inbound_ifaddr
> 
> When icmp_send is called on the local output path before the
> packet hits ip_output, skb->dev is not set, causing a crash
> when sysctl_icmp_errors_use_inbound_ifaddr is set. This can
> happen with the netfilter REJECT target or IPsec tunnels.
> 
> Let routing decide the ICMP source address in that case, since the
> packet is locally generated there is no inbound interface and
> the sysctl should not apply.
> 
> The option actually seems to be unfixable broken, on the path
> after ip_output() skb->dev points to the outgoing device and
> we don't know the incoming device anymore, so its going to do
> the absolute wrong thing and pick the address of the outgoing
> interface. Add a comment about this.
> 
> Reported by Curtis Doty <Curtis@...enKey.net>.
> 
> Signed-off-by: Patrick McHardy <kaber@...sh.net>

Applied, thanks for the fix Patrick.

The post ip_output() case is very unfortunate.  Perhaps we
can tag the call sites, or if that doesn't work we can
find some way to perhaps tag the dst as an input vs. output
route in order to avoid this problem.
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html