netdev - Re: mac80211 truesize bugs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1209643524.3904.5.camel@johannes.berg>
Date:	Thu, 01 May 2008 14:05:24 +0200
From:	Johannes Berg <johannes@...solutions.net>
To:	David Miller <davem@...emloft.net>
Cc:	herbert@...dor.apana.org.au, mb@...sch.de, netdev@...r.kernel.org,
	linux-wireless@...r.kernel.org
Subject: Re: mac80211 truesize bugs


> That makes more sense, good catch Herbert.
> 
> I guess it's the pskb_expand_head() calls done by net/mac80211/tx.c
> I suspect we'll need to orphan early in order to accomodate these
> adjustments, otherwise socket memory buffer allocations will
> be corrupted.
> 
> Once that is cured, I think we can detect this better, by adding a
> carefully constructed assertion to pskb_expand_head().  Basically, the
> idea is, if "nhead" or "ntail" are non-zero, and there is a socket
> still attached to the SKB, print a warning message.

I'm confused now. I added this patch:

--- everything.orig/net/core/skbuff.c	2008-05-01 13:21:52.000000000 +0200
+++ everything/net/core/skbuff.c	2008-05-01 13:29:57.000000000 +0200
@@ -683,6 +683,14 @@ int pskb_expand_head(struct sk_buff *skb
 	if (!data)
 		goto nodata;
 
+	if (unlikely((nhead || ntail) && skb->sk)) {
+		printk(KERN_ERR "SKB BUG: Illegal pskb expand (%d:%d) "
+				"with socket attached\n",
+		       nhead, ntail);
+                dump_stack();
+	} else
+		skb->truesize = size + sizeof(struct sk_buff);
+
 	/* Copy only real data... and, alas, header. This should be
 	 * optimized for the cases when header is void. */
 #ifdef NET_SKBUFF_DATA_USES_OFFSET
--- everything.orig/net/mac80211/tx.c	2008-05-01 13:01:09.000000000 +0200
+++ everything/net/mac80211/tx.c	2008-05-01 13:16:50.000000000 +0200
@@ -1279,6 +1279,8 @@ int ieee80211_master_start_xmit(struct s
 	int headroom;
 	int ret;
 
+	skb_orphan(skb);
+
 	if (info->flags & IEEE80211_TX_CTL_READY_FOR_TX) {
 		/*
 		 * We set the IEEE80211_TX_CTL_READY_FOR_TX bit in all skbs
@@ -1581,6 +1583,7 @@ int ieee80211_subif_start_xmit(struct sk
 	 * us broadcast frames. */
 
 	if (head_need > 0 || skb_cloned(skb)) {
+		skb_orphan(skb);
 #if 0
 		printk(KERN_DEBUG "%s: need to reallocate buffer for %d bytes "
 		       "of headroom\n", dev->name, head_need);


and the assertion never triggers, however I get a number of bugs like this:

SKB BUG: Invalid truesize (4294963740) len=44, sizeof(sk_buff)=176, skb=0xeecb6620

and definitely cannot explain that number (-3556).

johannes

Download attachment "signature.asc" of type "application/pgp-signature" (829 bytes)