netdev - skb_try_coalesce bug?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20140422120125.GC7019@eerihug-hybrid.rnd.ki.sw.ericsson.se>
Date:	Tue, 22 Apr 2014 14:01:25 +0200
From:	Erik Hugne <erik.hugne@...csson.com>
To:	<netdev@...r.kernel.org>
Subject: skb_try_coalesce bug?

It seems that if the head skb of a reassembly chain have enough tailroom
to hold the data of a received fragment, skb_try_coalesce() will append this
directly to the head, even if preceding fragments have been put on a frag list.
This will cause a corrupted buffer to be passed to userland when 
skb_copy_datagram_iovec() later copies the contents of head, and then each frag
one by one to the target iovec.

Is skb_try_coalesce() broken, or are we using it wrongly in tipc?

//E

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html