netdev - Re: [PATCH v2] net: netem: fix skb length BUG_ON in __skb_to

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 28 Feb 2019 10:32:55 -0800 (PST)
From:   David Miller <davem@...emloft.net>
To:     lansheng@...wei.com
Cc:     eric.dumazet@...il.com, stephen@...workplumber.org,
        netdev@...r.kernel.org, netem@...ts.linux-foundation.org,
        xuhanbing@...wei.com, zhengshaoyu@...wei.com, jiqin.ji@...wei.com,
        liuzhiqiang26@...wei.com, yuehaibing@...wei.com
Subject: Re: [PATCH v2] net: netem: fix skb length BUG_ON in __skb_to_sgvec

From: Sheng Lan <lansheng@...wei.com>
Date: Thu, 28 Feb 2019 18:47:58 +0800

> From: Sheng Lan <lansheng@...wei.com>
> 
> It can be reproduced by following steps:
> 1. virtio_net NIC is configured with gso/tso on
> 2. configure nginx as http server with an index file bigger than 1M bytes
> 3. use tc netem to produce duplicate packets and delay:
>    tc qdisc add dev eth0 root netem delay 100ms 10ms 30% duplicate 90%
> 4. continually curl the nginx http server to get index file on client
> 5. BUG_ON is seen quickly
 ...
> In __skb_to_sgvec(), the skb->len is not equal to the sum of the skb's
> linear data size and nonlinear data size, thus BUG_ON triggered.
> Because the skb is cloned and a part of nonlinear data is split off.
> 
> Duplicate packet is cloned in netem_enqueue() and may be delayed
> some time in qdisc. When qdisc len reached the limit and returns
> NET_XMIT_DROP, the skb will be retransmit later in write queue.
> the skb will be fragmented by tso_fragment(), the limit size
> that depends on cwnd and mss decrease, the skb's nonlinear
> data will be split off. The length of the skb cloned by netem
> will not be updated. When we use virtio_net NIC and invoke skb_to_sgvec(),
> the BUG_ON trigger.
> 
> To fix it, netem returns NET_XMIT_SUCCESS to upper stack
> when it clones a duplicate packet.
> 
> Fixes: 35d889d1 ("sch_netem: fix skb leak in netem_enqueue()")
> Signed-off-by: Sheng Lan <lansheng@...wei.com>
> Reported-by: Qin Ji <jiqin.ji@...wei.com>
> Suggested-by: Eric Dumazet <eric.dumazet@...il.com>

Applied and queued up for -stable, thanks.