netdev - [PATCH] net: Fix skb_network_offset in neigh_resolve_output and neigh_connected

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Thu, 16 Jun 2016 08:50:21 +0200
From:	Abdelrhman Ahmed <ab@...hmed.com>
To:	netdev@...r.kernel.org
Subject: [PATCH] net: Fix skb_network_offset in neigh_resolve_output and
 neigh_connected_output

Commit e1f165032c8bade3a6bdf546f8faf61fda4dd01c ("net: Fix 
skb_under_panic oops in neigh_resolve_output") resets the skb to 
network_header, but this will discard header or data which is inserted 
by netfilter hooks (e.g. POSTROUTING) between network layer and hardware 
header only for the first packet(s) before using cached hardware header 
and this will lead to inconsistent behavior for outgoing packets.
The fix is to reset with reference to skb's data pointer before loop 
instead of network header.

Signed-off-by: Abdelrhman Ahmed <ab@...hmed.com>
--- net/core/neighbour.c.orig    2016-06-16 05:52:26.521301488 +0200
+++ net/core/neighbour.c    2016-06-16 08:09:54.577222828 +0200
@@ -1293,15 +1293,19 @@ int neigh_resolve_output(struct neighbou
      int rc = 0;

      if (!neigh_event_send(neigh, skb)) {
-        int err;
+        int err, offset;
          struct net_device *dev = neigh->dev;
+        unsigned char *data;
          unsigned int seq;

          if (dev->header_ops->cache && !neigh->hh.hh_len)
              neigh_hh_init(neigh);

+        data = skb->data;
+
          do {
-            __skb_pull(skb, skb_network_offset(skb));
+            offset = data - skb->data;
+            __skb_pull(skb, offset);
              seq = read_seqbegin(&neigh->ha_lock);
              err = dev_hard_header(skb, dev, ntohs(skb->protocol),
                            neigh->ha, NULL, skb->len);
@@ -1326,11 +1330,15 @@ EXPORT_SYMBOL(neigh_resolve_output);
  int neigh_connected_output(struct neighbour *neigh, struct sk_buff *skb)
  {
      struct net_device *dev = neigh->dev;
+    unsigned char *data;
      unsigned int seq;
-    int err;
+    int err, offset;
+
+    data = skb->data;

      do {
-        __skb_pull(skb, skb_network_offset(skb));
+        offset = data - skb->data;
+        __skb_pull(skb, offset);
          seq = read_seqbegin(&neigh->ha_lock);
          err = dev_hard_header(skb, dev, ntohs(skb->protocol),
                        neigh->ha, NULL, skb->len);

-- 
Regards,
Abdelrhman