netdev - Re: [PATCH net] phonet: properly unshare skbs in phonet

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Wed, 13 Jan 2016 07:07:32 -0800
From:	Eric Dumazet <eric.dumazet@...il.com>
To:	Rémi Denis-Courmont <remi@...lab.net>
Cc:	Network Development <netdev@...r.kernel.org>
Subject: Re: [PATCH net] phonet: properly unshare skbs in phonet_rcv()

On Wed, 2016-01-13 at 14:26 +0200, Rémi Denis-Courmont wrote:
> Le 2016-01-12 18:58, Eric Dumazet a écrit :
> > From: Eric Dumazet <edumazet@...gle.com>
> >
> > Ivaylo Dimitrov reported a regression caused by commit 7866a621043f
> > ("dev: add per net_device packet type chains").
> >
> > skb->dev becomes NULL and we crash in __netif_receive_skb_core().
> >
> > Before above commit, different kind of bugs or corruptions could 
> > happen
> > without major crash.
> 
> Hmm... was that always a problem then, or did it get introduced 
> earlier? I thought it was impossible for skb to be shared on PF-recv 
> callback way back.

Always been a problem.

Use tcpdump and you risk use after free.

Or simply panics if skb->head needs to be expanded.

Other relevant commits to explain this :

044453b3efdc90bdd5feffe74b99d95dec70ac43 arp: fix possible crash in
arp_rcv()

b30532515f0a62bfe17207ab00883dd262497006 bonding: Ensure that we unshare
skbs prior to calling pskb_may_pull