netdev - Re: [PATCH net] ipv4: Avoid crashing in ip

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <f68c1ee01934e4ce4e4379af7a72327a@vittgam.net>
Date:	Sat, 23 May 2015 18:59:45 +0200
From:	"Vittorio G (VittGam)" <linuxbugs@...tgam.net>
To:	<ebiederm@...ssion.com>, Julian Anastasov <ja@....bg>
Cc:	David Miller <davem@...emloft.net>, <netdev@...r.kernel.org>,
	<security@...nel.org>, Greg KH <greg@...ah.com>,
	<luto@...capital.net>, Willy Tarreau <w@....eu>
Subject: Re: [PATCH net] ipv4: Avoid crashing in ip_error

Il 23.05.2015 16:40 ebiederm@...ssion.com ha scritto:
> The reproducer was apparently:
> ip netns add ns0
> ip netns add ns1
> ip link add test0 type veth peer name test1
> ip link set test0 netns ns0
> ip link set test1 netns ns1
> ip netns exec ns0 sysctl net.ipv4.ip_forward=1
> ip netns exec ns1 sysctl net.ipv4.ip_forward=1
> ip netns exec ns0 sysctl net.ipv4.conf.all.accept_local=1
> ip netns exec ns1 sysctl net.ipv4.conf.all.accept_local=1
> ip netns exec ns0 sysctl net.ipv4.conf.test0.accept_local=1
> ip netns exec ns1 sysctl net.ipv4.conf.test1.accept_local=1
> ip netns exec ns0 sysctl net.ipv4.conf.all.send_redirects=0
> ip netns exec ns1 sysctl net.ipv4.conf.all.send_redirects=0
> ip netns exec ns0 sysctl net.ipv4.conf.test0.send_redirects=0
> ip netns exec ns1 sysctl net.ipv4.conf.test1.send_redirects=0
> ip netns exec ns0 ip addr add 10.10.10.1/24 dev test0
> ip netns exec ns1 ip addr add 10.10.10.2/24 dev test1
> ip netns exec ns0 ip link set up dev test0
> ip netns exec ns1 ip link set up dev test1
> ip netns exec ns0 ip route add 10.20.30.40 via 10.10.10.2 dev test0
> ip netns exec ns1 ip route add 10.20.30.40 via 10.10.10.1 dev test1
> ip netns exec ns0 iptables -t mangle -A PREROUTING -i test0 -j TTL --ttl-inc 1
> ip netns exec ns1 iptables -t mangle -A PREROUTING -i test1 -j TTL --ttl-inc 1
> ip netns exec ns0 ping -s 1400 -f -w 5 10.20.30.40
> ip netns delete ns0
> ip netns delete ns1

Yes, and the commands were ultimately wrapped in a "while true; do ... done" loop,
since the crash would not happen every time, but it eventually will, without the
patch.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html