netdev - Re: [PATCH] net: Fix resetting network_header in neigh_resolve_output and neigh_connected

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Fri, 01 Jul 2016 15:57:39 -0400 (EDT)
From:	David Miller <davem@...emloft.net>
To:	ab@...hmed.com
Cc:	netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] net: Fix resetting network_header in
 neigh_resolve_output and neigh_connected_output

From: Abdelrhman Ahmed <ab@...hmed.com>
Date: Mon, 27 Jun 2016 16:28:59 +0200

> @@ -1293,15 +1293,19 @@ int neigh_resolve_output(struct neighbour *neigh, struct sk_buff *skb)
>  	int rc = 0;
>  
>  	if (!neigh_event_send(neigh, skb)) {
> -		int err;
> +		int err, offset;
>  		struct net_device *dev = neigh->dev;
> +		unsigned char *data;
>  		unsigned int seq;
>  
>  		if (dev->header_ops->cache && !neigh->hh.hh_len)
>  			neigh_hh_init(neigh);
>  
> +		data = skb->data;
> +
>  		do {
> -			__skb_pull(skb, skb_network_offset(skb));
> +			offset = data - skb->data;
> +			__skb_pull(skb, offset);

This is definitely not right, using skb->data for this.  It may work
for the cases you have tested but it is not generally correct.

You must use the skb network header.

You are just trying to avoid doing the pull more than once if we loop
right?  Then simply use a boolean to track that.