netdev - Re: FW: Re: [PATCH v3 4/4] packet: Add pre-defragmentation support for ipv4

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1309965489.2292.27.camel@edumazet-HP-Compaq-6005-Pro-SFF-PC>
Date:	Wed, 06 Jul 2011 17:18:09 +0200
From:	Eric Dumazet <eric.dumazet@...il.com>
To:	Penttilä Mika <mika.penttila@...nos.com>
Cc:	"netdev@...r.kernel.org" <netdev@...r.kernel.org>,
	"davem@...emloft.net" <davem@...emloft.net>
Subject: Re: FW: Re: [PATCH v3 4/4] packet: Add pre-defragmentation support
 for ipv4

Le mercredi 06 juillet 2011 à 14:06 +0000, Penttilä Mika a écrit :
> 
> > +static struct sk_buff *fanout_check_defrag(struct sk_buff *skb)
> > +{
> > +	const struct iphdr *iph;
> > +	u32 len;
> > +
> > +	if (skb->protocol != htons(ETH_P_IP))
> > +		return skb;
> > +
> > +	if (!pskb_may_pull(skb, sizeof(struct iphdr)))
> > +		return skb;
> > +
> > +	iph = ip_hdr(skb);
> > +	if (iph->ihl < 5 || iph->version != 4)
> > +		return skb;
> > +	if (!pskb_may_pull(skb, iph->ihl*4))
> > +		return skb;
> > +	iph = ip_hdr(skb);
> > +	len = ntohs(iph->tot_len);
> > +	if (skb->len < len || len < (iph->ihl * 4))
> > +		return skb;
> > +
> > +	if (ip_is_fragment(ip_hdr(skb))) {
> > +		skb = skb_clone(skb, GFP_ATOMIC);
> 
> Isn't this leaking the original skb?

Yes, there are several problems here.

More fundamentally, there is a problem if two (or more) applications use
FANOUT sockets.

Only one will get the defragmented packet.

We probably need to have separate frag lists, or adding/using skb->sk as
a key.

Thanks


[PATCH] packet: fix a leak in fanout_check_defrag()

Reported-by: Penttilä Mika <mika.penttila@...nos.com>
Signed-off-by: Eric Dumazet <eric.dumazet@...il.com>
---
 net/packet/af_packet.c |   21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 41f0489..69238f6 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -476,15 +476,20 @@ static struct sk_buff *fanout_check_defrag(struct sk_buff *skb)
 		return skb;
 
 	if (ip_is_fragment(ip_hdr(skb))) {
-		skb = skb_clone(skb, GFP_ATOMIC);
-		if (skb) {
-			if (pskb_trim_rcsum(skb, len))
-				return skb;
-			memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
-			if (ip_defrag(skb, IP_DEFRAG_AF_PACKET))
-				return NULL;
-			skb->rxhash = 0;
+		struct sk_buff *nskb = skb_clone(skb, GFP_ATOMIC);
+
+		if (!nskb)
+			return skb;
+		if (pskb_trim_rcsum(nskb, len)) {
+			kfree_skb(nskb);
+			return skb;
 		}
+		kfree_skb(skb);
+		skb = nskb;
+		memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
+		if (ip_defrag(skb, IP_DEFRAG_AF_PACKET))
+			return NULL;
+		skb->rxhash = 0;
 	}
 	return skb;
 }


--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html