netdev - Re: BUG: NIU driver: strange issues with multicast "UDP: short packet"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1233837840.20497.129.camel@localhost.localdomain>
Date:	Thu, 05 Feb 2009 13:44:00 +0100
From:	Jesper Dangaard Brouer <jdb@...x.dk>
To:	David Miller <davem@...emloft.net>
Cc:	netdev@...r.kernel.org
Subject: Re: BUG: NIU driver: strange issues with multicast "UDP: short
	packet"

On Wed, 2009-02-04 at 01:00 -0800, David Miller wrote:
> > Yes, but this only happens on the NIU/netpune NIC.  I works with the
> igb
> > driver, I have both a 82575 and a 82576 NIC.
> 
> Right, and what's unique about NIU is that NIU won't prepull
> the protocol headers into the linear area on receive.
> 
> At the point when IPMR is dealing with potentially forwarding
> the frame, the UDP headers aren't yet pulled into the linear
> area.  UDP input will do that with it's pskb_may_pull() call.

I think I have found the problem.  And its actually due to the
pskb_may_pull() call in net/ipv4/udp.c:__udp4_lib_rcv().

pskb_may_pull() may alter the SKB and a pointer to the UDP header was
stored before the pskb_may_pull() call.

I'll send a patch...

-- 
Med venlig hilsen / Best regards
  Jesper Brouer
  ComX Networks A/S
  Linux Network developer
  Cand. Scient Datalog / MSc.
  Author of http://adsl-optimizer.dk
  LinkedIn: http://www.linkedin.com/in/brouer
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html