netdev - Re: [PATCH v2] iov_iter: don't revert iov buffer if csum error

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <0cc7c1d2-87d0-6cc4-624b-1cf96678bfd7@huawei.com>
Date:   Sat, 29 Apr 2017 17:37:38 +0800
From:   Ding Tianhong <dingtianhong@...wei.com>
To:     Al Viro <viro@...IV.linux.org.uk>
CC:     David Miller <davem@...emloft.net>, <pabeni@...hat.com>,
        <edumazet@...gle.com>, <hannes@...essinduktion.org>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        LinuxArm <linuxarm@...wei.com>,
        "weiyongjun (A)" <weiyongjun1@...wei.com>
Subject: Re: [PATCH v2] iov_iter: don't revert iov buffer if csum error



On 2017/4/29 10:46, Al Viro wrote:
> On Sat, Apr 29, 2017 at 10:38:48AM +0800, Ding Tianhong wrote:
>> The patch 327868212381 (make skb_copy_datagram_msg() et.al. preserve
>> ->msg_iter on error) will revert the iov buffer if copy to iter
>> failed, but it didn't copy any datagram if the skb_checksum_complete
>> error, so no need to revert any data at this place.
> 
> The bug is real, but I would suggest a simpler fix:
>                 if (__skb_checksum_complete(skb))
>                         return -EINVAL;
> leaving the rest as-is.
> 
Looks good, if so, we don't need the csum_error any more,

-		if (csum_fold(csum))
+
+		if (csum_fold(csum)) {
+			iov_iter_revert(&msg->msg_iter, chunk);
+ 			return -EINVAL;
+		}
+
 		if (unlikely(skb->ip_summed == CHECKSUM_COMPLETE))
 			netdev_rx_csum_fault(skb->dev);
 	}
 	return 0;
- csum_error:
-	iov_iter_revert(&msg->msg_iter, chunk);
- 	return -EINVAL;
 fault:
 	return -EFAULT;

DO you agree this way? :)

Thanks
Ding

> .
>