netdev - Re: [PANIC] lro + iscsi or lro + skb text search causes panic

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20090126223022.GA24046@gondor.apana.org.au>
Date:	Tue, 27 Jan 2009 09:30:22 +1100
From:	Herbert Xu <herbert@...dor.apana.org.au>
To:	David Miller <davem@...emloft.net>
Cc:	michaelc@...wisc.edu, jesse.brandeburg@...el.com,
	netdev@...r.kernel.org, olaf.kirch@...cle.com, tgraf@...g.ch,
	kkeil@...e.de
Subject: Re: [PANIC] lro + iscsi or lro + skb text search causes panic

On Sun, Jan 25, 2009 at 09:32:22PM -0800, David Miller wrote:
> From: Mike Christie <michaelc@...wisc.edu>
> Date: Thu, 22 Jan 2009 18:04:11 -0600
> 
> > With the patch running against linus's git tree, my box locks
> > up. You cannot ping it. I do not get a oops or anything in the logs,
> > and the keyboard does not respond. I will try to get some oops
> > output and more info.
> 
> Herbert, any idea offhand?

Yeah, I missed an offset update in there :) Here's a better version.

net: Fix frag_list handling in skb_seq_read

The frag_list handling was broken in skb_seq_read:

1) We didn't add the stepped offset when looking at the head
are of fragments other than the first.

2) We didn't take the stepped offset away when setting the data
pointer in the head area.

3) The frag index wasn't reset.

This patch fixes both issues.

Signed-off-by: Herbert Xu <herbert@...dor.apana.org.au>

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index d7efaf9..d4d0e31 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2215,10 +2215,10 @@ unsigned int skb_seq_read(unsigned int consumed, const u8 **data,
 		return 0;
 
 next_skb:
-	block_limit = skb_headlen(st->cur_skb);
+	block_limit = skb_headlen(st->cur_skb) + st->stepped_offset;
 
 	if (abs_offset < block_limit) {
-		*data = st->cur_skb->data + abs_offset;
+		*data = st->cur_skb->data + (abs_offset - st->stepped_offset);
 		return block_limit - abs_offset;
 	}
 
@@ -2260,6 +2260,7 @@ next_skb:
 	} else if (st->root_skb == st->cur_skb &&
 		   skb_shinfo(st->root_skb)->frag_list) {
 		st->cur_skb = skb_shinfo(st->root_skb)->frag_list;
+		st->frag_idx = 0;
 		goto next_skb;
 	}
 
Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@...dor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html