netdev - Re: [PATCH] ipv6: frags: Fix bogus skb->sk in reassembled packets

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 20 Dec 2018 05:26:51 -0800
From:   Eric Dumazet <edumazet@...gle.com>
To:     Herbert Xu <herbert@...dor.apana.org.au>
Cc:     Steffen Klassert <steffen.klassert@...unet.com>,
        netdev <netdev@...r.kernel.org>, xmu@...hat.com
Subject: Re: [PATCH] ipv6: frags: Fix bogus skb->sk in reassembled packets

On Thu, Dec 20, 2018 at 5:20 AM Herbert Xu <herbert@...dor.apana.org.au> wrote:
>
> It was reported that IPsec would crash when it encounters an IPv6
> reassembled packet because skb->sk is non-zero and not a valid
> pointer.
>
> This is because skb->sk is now a union with ip_defrag_offset.
>
> This patch fixes this by resetting skb->sk when exiting from
> the reassembly code.
>
> Reported-by: Xiumei Mu <xmu@...hat.com>
> Fixes: 219badfaade9 ("ipv6: frags: get rid of ip6frag_skb_cb/...")
> Signed-off-by: Herbert Xu <herbert@...dor.apana.org.au>
>
> diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
> index 5c3c92713096..a98f95fb6eac 100644
> --- a/net/ipv6/reassembly.c
> +++ b/net/ipv6/reassembly.c
> @@ -378,6 +378,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
>                 if (skb_try_coalesce(head, fp, &headstolen, &delta)) {
>                         kfree_skb_partial(fp, headstolen);
>                 } else {
> +                       fp->sk = NULL;
>                         if (!skb_shinfo(head)->frag_list)
>                                 skb_shinfo(head)->frag_list = fp;
>                         head->data_len += fp->len;


I wonder why this have not been done earlier in commit

commit 5d407b071dc369c26a38398326ee2be53651cfe4
Author: Taehee Yoo <ap420073@...il.com>
Date:   Mon Sep 10 02:47:05 2018 +0900

    ip: frags: fix crash in ip_do_fragment()

Maybe because the Fixes tag mentioned fa0f527358bd ("ip: use rb trees
for IP frag queue.")
and IPv6 reasm was not using rbtree ...

Oh well.