netdev - Re: [Bugme-new] [Bug 10903] New: ssh connections hang with 2.6.26-rc5

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20080618.010528.05757230.davem@davemloft.net>
Date:	Wed, 18 Jun 2008 01:05:28 -0700 (PDT)
From:	David Miller <davem@...emloft.net>
To:	johannes@...solutions.net
Cc:	ilpo.jarvinen@...sinki.fi, didier@...oud.com,
	akpm@...ux-foundation.org, netdev@...r.kernel.org,
	bugme-daemon@...zilla.kernel.org, linux-wireless@...r.kernel.org
Subject: Re: [Bugme-new] [Bug 10903] New: ssh connections hang with
 2.6.26-rc5

From: Johannes Berg <johannes@...solutions.net>
Date: Wed, 18 Jun 2008 09:24:47 +0200

> 
> > > > > > > > http://bugzilla.kernel.org/show_bug.cgi?id=10903
> > > > > > > >
> > > > > > > >            Summary: ssh connections hang with 2.6.26-rc5
> 
> Andrew Prince reported a similar problem and said he bisected it  to
> davem's 608961a5eca8d3c6bd07172febc27b5559408c5d ("mac80211: Use
> skb_header_cloned() on TX path.") which made no sense to me so I marked
> the report as 'to investigate when I have more time'.

That's useful information.  The kernel bugzilla entry is for
the iwl3945 driver, so that matches up accurately with this
too.

If we can't figure out what's going on here soon (like, in less than a
day) we should revert that changeset.

Actually, I think I see how the changeset might be wrong.  I think
the encryption layer of mac80211 assumes it can write over the
data area of the SKB it's working on, not just the headers.

Once this happens, any retransmits done by SKB will fail because the
master packet data on TCP's retransmit queue is now this encrypted
garbage.