netdev - regression caused by 1d2024f61ec14bdb0c57a97a3fe73685abc2d198?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20130206114321.GA13497@redhat.com>
Date:	Wed, 6 Feb 2013 13:43:21 +0200
From:	"Michael S. Tsirkin" <mst@...hat.com>
To:	alexander.h.duyck@...el.com, stephen.s.ko@...el.com,
	jeffrey.t.kirsher@...el.com, David Miller <davem@...emloft.net>,
	netdev@...r.kernel.org
Subject: regression caused by 1d2024f61ec14bdb0c57a97a3fe73685abc2d198?

It seems that starting with kernel 3.3 ixgbe sets gso_size for
incoming frames. It seems that this might result in gso_size
being set even when gso_type is 0.
This in turn leads to a crash at macvtap_skb_to_vnet_hdr
drivers/net/macvtap.c:628
which has this code:

       if (skb_is_gso(skb)) {
                struct skb_shared_info *sinfo = skb_shinfo(skb);

                /* This is a hint as to how much should be linear. */
                vnet_hdr->hdr_len = skb_headlen(skb);
                vnet_hdr->gso_size = sinfo->gso_size;
                if (sinfo->gso_type & SKB_GSO_TCPV4)
                        vnet_hdr->gso_type = VIRTIO_NET_HDR_GSO_TCPV4;
                else if (sinfo->gso_type & SKB_GSO_TCPV6)
                        vnet_hdr->gso_type = VIRTIO_NET_HDR_GSO_TCPV6;
                else if (sinfo->gso_type & SKB_GSO_UDP)
                        vnet_hdr->gso_type = VIRTIO_NET_HDR_GSO_UDP;
                else
                        BUG();
                if (sinfo->gso_type & SKB_GSO_TCP_ECN)
                        vnet_hdr->gso_type |= VIRTIO_NET_HDR_GSO_ECN;
        } else
                vnet_hdr->gso_type = VIRTIO_NET_HDR_GSO_NONE;


Since skb_is_gso tests gso_size.

What's the right way to handle this? Should skb_is_gso be
changed to test gso_type != 0?

-- 
MST
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html