netdev - [PATCH] rionet: Don't try to corrupt skbuff assigning data pointer directly

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <5593E497.40804@nokia.com>
Date:	Wed, 1 Jul 2015 15:01:11 +0200
From:	Alexander Sverdlin <alexander.sverdlin@...ia.com>
To:	netdev@...r.kernel.org, David Miller <davem@...emloft.net>,
	Matt Porter <mporter@...nel.crashing.org>
Cc:	Alexandre Bounine <alexandre.bounine@....com>,
	Frank Kunz <frank.kunz@...ia.com>,
	Marek Krzyzowski <marek.krzyzowski@...ia.com>
Subject: [PATCH] rionet: Don't try to corrupt skbuff assigning data pointer
 directly

It's not allowed to assign data pointer of skbuff directly, this makes no sense
if the assigned pointer is the very same as already existing one, or it brakes
all the pointer arithmetics in all other cases. We cannot do better as just
compare them and report BUG() in case of mismatch.

Signed-off-by: Alexander Sverdlin <alexander.sverdlin@...ia.com>
---

We came across this problem developing new code for Octeon2 RAPIDIO. For the last
10 years since original commit of the code this assignment did nothing as the
pointers were always same. But the bug in the new code discovered this one. So
better do BUG() immediately here, this would prevent longer debugging of the
following skbuff corruption.

 drivers/net/rionet.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/rionet.c b/drivers/net/rionet.c
index dac7a0d..34c27b8 100644
--- a/drivers/net/rionet.c
+++ b/drivers/net/rionet.c
@@ -104,7 +104,8 @@ static int rionet_rx_clean(struct net_device *ndev)
 		if (!(data = rio_get_inb_message(rnet->mport, RIONET_MAILBOX)))
 			break;

-		rnet->rx_skb[i]->data = data;
+		if (rnet->rx_skb[i]->data != data)
+			BUG();
 		skb_put(rnet->rx_skb[i], RIO_MAX_MSG_SIZE);
 		rnet->rx_skb[i]->protocol =
 		    eth_type_trans(rnet->rx_skb[i], ndev);
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html