lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 12 Aug 2015 21:55:50 -0700 From: Alexei Starovoitov <alexei.starovoitov@...il.com> To: Linus Lüssing <linus.luessing@...3.blue> Cc: netdev@...r.kernel.org, bridge@...ts.linux-foundation.org, linux-kernel@...r.kernel.org, Stephen Hemminger <stephen@...workplumber.org>, "David S. Miller" <davem@...emloft.net>, Herbert Xu <herbert@...dor.apana.org.au>, Brenden Blanco <bblanco@...mgrid.com> Subject: Re: [PATCH] net: fix wrong skb_get() usage / crash in IGMP/MLD parsing code On Thu, Aug 13, 2015 at 05:54:07AM +0200, Linus Lüssing wrote: > The recent refactoring of the IGMP and MLD parsing code into > ipv6_mc_check_mld() / ip_mc_check_igmp() introduced a potential crash / > BUG() invocation for bridges: > > I wrongly assumed that skb_get() could be used as a simple reference > counter for an skb which is not the case. skb_get() bears additional > semantics, a user count. This leads to a BUG() invocation in > pskb_expand_head() / kernel panic if pskb_may_pull() is called on an skb > with a user count greater than one - unfortunately the refactoring did > just that. > > Fixing this by removing the skb_get() call and changing the API: The > caller of ipv6_mc_check_mld() / ip_mc_check_igmp() now needs to > additionally check whether the returned skb_trimmed is a clone. > > Fixes: 9afd85c9e455 ("net: Export IGMP/MLD message validation code") > Reported-by: Brenden Blanco <bblanco@...mgrid.com> > Signed-off-by: Linus Lüssing <linus.luessing@...3.blue> I think the fix actually made the code easier to read. Thank you. Looks good to me. Acked-by: Alexei Starovoitov <ast@...mgrid.com> -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists