netdev - Re: [patch 1/2] af_iucv: recvmsg: use correct skb

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1364917039.5113.170.camel@edumazet-glaptop>
Date:	Tue, 02 Apr 2013 08:37:19 -0700
From:	Eric Dumazet <eric.dumazet@...il.com>
To:	frank.blaschka@...ibm.com
Cc:	davem@...emloft.net, netdev@...r.kernel.org,
	linux-s390@...r.kernel.org,
	Hendrik Brueckner <brueckner@...ux.vnet.ibm.com>
Subject: Re: [patch 1/2] af_iucv: recvmsg: use correct skb_pull() function

On Tue, 2013-04-02 at 12:56 +0200, frank.blaschka@...ibm.com wrote:
> plain text document attachment (601-af-iucv-skb-pull.diff)
> From: Hendrik Brueckner <brueckner@...ux.vnet.ibm.com>
> 
> When receiving data messages, the "BUG_ON(skb->len < skb->data_len)" in
> the skb_pull() function triggers a kernel panic.
> 
> Check if the skb uses paged data (is non-linear) and use the pskb_pull()
> function.  Use skb_pull() for linear skbs' only.
> 
> Reviewed-by: Ursula Braun <ursula.braun@...ibm.com>
> Signed-off-by: Hendrik Brueckner <brueckner@...ux.vnet.ibm.com>
> Signed-off-by: Frank Blaschka <blaschka@...ux.vnet.ibm.com>
> ---
>  net/iucv/af_iucv.c |    5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> --- a/net/iucv/af_iucv.c
> +++ b/net/iucv/af_iucv.c
> @@ -1382,7 +1382,10 @@ static int iucv_sock_recvmsg(struct kioc
>  
>  		/* SOCK_STREAM: re-queue skb if it contains unreceived data */
>  		if (sk->sk_type == SOCK_STREAM) {
> -			skb_pull(skb, copied);
> +			if (skb_is_nonlinear(skb))
> +				pskb_pull(skb, copied);
> +			else
> +				skb_pull(skb, copied);
>  			if (skb->len) {
>  				skb_queue_head(&sk->sk_receive_queue, skb);
>  				goto done;

That cant be right. You can not ignore pskb_pull() return value.

Its also not very efficient.

I would advise using a per skb offset, to avoid skb_pull()



--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html