netdev - Re: [PATCH] llc_cmsg_rcv was getting called after sk_eat

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAEnQRZAWpjZ2gm9wgoqdyHmKQ=geoXNC0kdVL4fT0Vrk54E1Ew@mail.gmail.com>
Date:	Fri, 16 Dec 2011 17:29:24 +0200
From:	Daniel Baluta <dbaluta@...acom.com>
To:	Alexandru Juncu <ajuncu@...acom.com>
Cc:	acme@...stprotocols.net, davem@...emloft.net,
	netdev@...r.kernel.org, alex.juncu@...edu.org,
	Kunjan Naik <knaik@...acom.com>,
	Eric Dumazet <eric.dumazet@...il.com>
Subject: Re: [PATCH] llc_cmsg_rcv was getting called after sk_eat_skb.

Hello Alex,

Please add a llc: prefix to the Subject. Also the title
should suggest what is the patch supposed to do.

e.g:

llc: Don't call llc_cmsg_rcv after sk_eat_skb

On Fri, Dec 16, 2011 at 11:01 AM, Alexandru Juncu <ajuncu@...acom.com> wrote:
> Received non stream protocol packets were calling llc_cmsg_rcv that used a
> skb after that skb was released by sk_eat_skb. This caused received STP
> packets to generate kernel panics.
>
> Signed-off-by: Alexandru Juncu <ajuncu@...acom.com>
> Signed-off-by: Kunjan Naik <knaik@...acom.com>
> ---
>  net/llc/af_llc.c |   14 ++++++++++----
>  1 files changed, 10 insertions(+), 4 deletions(-)
>
> diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
> index dfd3a64..a18e6c3 100644
> --- a/net/llc/af_llc.c
> +++ b/net/llc/af_llc.c
> @@ -833,15 +833,15 @@ static int llc_ui_recvmsg(struct kiocb *iocb, struct socket *sock,
>                copied += used;
>                len -= used;
>
> +               /* For non stream protcols we get one packet per recvmsg call */
> +               if (sk->sk_type != SOCK_STREAM)
> +                       goto copy_uaddr;
> +
>                if (!(flags & MSG_PEEK)) {
>                        sk_eat_skb(sk, skb, 0);
>                        *seq = 0;
>                }
>
> -               /* For non stream protcols we get one packet per recvmsg call */
> -               if (sk->sk_type != SOCK_STREAM)
> -                       goto copy_uaddr;
> -
>                /* Partial read */
>                if (used + offset < skb->len)
>                        continue;
> @@ -857,6 +857,12 @@ copy_uaddr:
>        }
>        if (llc_sk(sk)->cmsg_flags)
>                llc_cmsg_rcv(msg, skb);
> +
> +       if (!(flags & MSG_PEEK)) {
> +                       sk_eat_skb(sk, skb, 0);
> +                       *seq = 0;
> +       }
> +
>        goto out;
>  }
>
> --
> 1.7.4.1

David, Eric could you please review this?

thanks,
Daniel.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html