netdev - Re: Bug in computing data_len in tcp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1322857369.2762.63.camel@edumazet-laptop>
Date:	Fri, 02 Dec 2011 21:22:49 +0100
From:	Eric Dumazet <eric.dumazet@...il.com>
To:	David Miller <davem@...emloft.net>
Cc:	subramanian.vijay@...il.com, therbert@...gle.com,
	netdev@...r.kernel.org
Subject: Re: Bug in computing data_len in tcp_sendmsg?

Le vendredi 02 décembre 2011 à 13:40 -0500, David Miller a écrit :

> Yes, for non-SG this always was technically possible.
> 

Yes this can, I reproduced it very easily.

I find this hard to believe...

[ 2179.697991] ------------[ cut here ]------------
[ 2179.698000] WARNING: at net/ipv4/tcp_output.c:850 tcp_transmit_skb+0x846/0x8f0()
[ 2179.698001] Hardware name: ProLiant BL460c G6
[ 2179.698011] Pid: 0, comm: swapper Tainted: G        W    3.2.0-rc2+ #187
[ 2179.698012] Call Trace:
[ 2179.698014]  <IRQ>  [<ffffffff8104715f>] warn_slowpath_common+0x7f/0xc0
[ 2179.698020]  [<ffffffff810471ba>] warn_slowpath_null+0x1a/0x20
[ 2179.698022]  [<ffffffff815d8386>] tcp_transmit_skb+0x846/0x8f0
[ 2179.698025]  [<ffffffff815d9621>] tcp_retransmit_skb+0x1a1/0x5f0
[ 2179.698027]  [<ffffffff815daf5d>] tcp_retransmit_timer+0x1bd/0x640
[ 2179.698030]  [<ffffffff815db578>] tcp_write_timer+0x198/0x200
[ 2179.698034]  [<ffffffff810579bf>] run_timer_softirq+0x12f/0x3e0
[ 2179.698039]  [<ffffffff81295924>] ? timerqueue_add+0x74/0xc0
[ 2179.698041]  [<ffffffff815db3e0>] ? tcp_retransmit_timer+0x640/0x640
[ 2179.698045]  [<ffffffff810753b5>] ? ktime_get+0x65/0xe0
[ 2179.698047]  [<ffffffff8104e929>] __do_softirq+0xa9/0x240
[ 2179.698050]  [<ffffffff81075b76>] ? do_timer+0x2b6/0x480
[ 2179.698053]  [<ffffffff8106fb90>] ? hrtimer_interrupt+0x130/0x220
[ 2179.698057]  [<ffffffff816d526c>] call_softirq+0x1c/0x30
[ 2179.698061]  [<ffffffff81004115>] do_softirq+0x55/0x90
[ 2179.698063]  [<ffffffff8104edde>] irq_exit+0x9e/0xc0
[ 2179.698066]  [<ffffffff816d5a3e>] smp_apic_timer_interrupt+0x6e/0x99
[ 2179.698068]  [<ffffffff816d3d8b>] apic_timer_interrupt+0x6b/0x70



diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 58f69ac..92ce7c3 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -847,6 +847,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
 
 	/* Build TCP header and checksum it. */
 	th = tcp_hdr(skb);
+	WARN_ON((((unsigned long)th) & 3) != 0);
 	th->source		= inet->inet_sport;
 	th->dest		= inet->inet_dport;
 	th->seq			= htonl(tcb->seq);


--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html