netdev - Re: general protection fault in skb

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAF=yD-LRz1pWKRhtbOSbBwa7ZMVLPoDtkKRXumzT4xEK3fUh3g@mail.gmail.com>
Date:   Sun, 31 Dec 2017 10:17:32 +0100
From:   Willem de Bruijn <willemdebruijn.kernel@...il.com>
To:     Xin Long <lucien.xin@...il.com>
Cc:     Marcelo Ricardo Leitner <marcelo.leitner@...il.com>,
        syzbot <syzbot+fee64147a25aecd48055@...kaller.appspotmail.com>,
        David Miller <davem@...emloft.net>,
        LKML <linux-kernel@...r.kernel.org>, linux-sctp@...r.kernel.org,
        Network Development <netdev@...r.kernel.org>,
        Neil Horman <nhorman@...driver.com>,
        syzkaller-bugs@...glegroups.com,
        Vlad Yasevich <vyasevich@...il.com>
Subject: Re: general protection fault in skb_segment

>> and with the reproducer, got:
>> [   54.255469] Bogus gso_type: 7
>> [   54.258801] Bogus gso_size: 63464
>> [   54.262532] ------------[ cut here ]------------
>> [   54.267703] syz0: caps=(0x00000800000058c1, 0x0000000000000000) len=32 data_len=0 gso_size=63464 gso_type=7 ip_summed0
>> [   54.279777] WARNING: CPU: 1 PID: 13005 at /root/linux/net/core/dev.c:2600 skb_warn_bad_offload+0xd6/0xec
> I couldn't reproduce this call trace on net-next, maybe it's been fixed by:
> commit 8d74e9f88d65af8bb2e095aff506aa6eac755ada
> Author: Willem de Bruijn <willemb@...gle.com>
> Date:   Tue Dec 12 11:39:04 2017 -0500
>
>     net: avoid skb_warn_bad_offload on IS_ERR

Yes, I forgot to mention that that has been fixed in net-next.

It does not address the crash, but does suppress the gratuitous
warning once we make segmentation return with error for bad
packets like these.