netdev - Re: [net PATCH] flow_dissector: Fix unaligned access in __skb_flow_dissector when used by eth_get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20160130191220.GB11601@oracle.com>
Date:	Sat, 30 Jan 2016 14:12:20 -0500
From:	Sowmini Varadhan <sowmini.varadhan@...cle.com>
To:	Tom Herbert <tom@...bertland.com>
Cc:	Eric Dumazet <eric.dumazet@...il.com>,
	Alexander Duyck <aduyck@...antis.com>,
	Linux Kernel Network Developers <netdev@...r.kernel.org>,
	"David S. Miller" <davem@...emloft.net>,
	Alexander Duyck <alexander.duyck@...il.com>
Subject: Re: [net PATCH] flow_dissector: Fix unaligned access in
 __skb_flow_dissector when used by eth_get_headlen

On (01/30/16 09:43), Tom Herbert wrote:
> That is not the only case, If a GRE TEB packet is ever received and
> flow dissector is called for any reason (like skb_get_hash) there's
> going to be problems-- and this doesn't require GRE to even be
> configured on the host.
> 
> I have a patch that changes the 32-bit accesses in flow_dissector to
> use get_unaligned_be32. I don't have access to any machines that care
> about alignment (only x86). Do you know if there is an alternate way
> to test this other than running on architecture like Sparc?

I can help test this on sparc (would help if you send me any special
config instructions for the GRE TEB case) , but the other way to test
it would be something similar to this:

--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -178,6 +178,8 @@ ip:
 
                ip_proto = iph->protocol;
 
+               WARN_ON_ONCE(!IS_ALIGNED(iph->saddr, 4));
+
                if (!dissector_uses_key(flow_dissector,
                                        FLOW_DISSECTOR_KEY_IPV4_ADDRS))