netdev - Re: [PATCH net] ipmr: Fix skb headroom in ipmr_get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Sat, 16 Nov 2019 13:09:12 -0800 (PST)
From:   David Miller <davem@...emloft.net>
To:     gnault@...hat.com
Cc:     jakub.kicinski@...ronome.com, netdev@...r.kernel.org,
        roopa@...ulusnetworks.com, pabeni@...hat.com
Subject: Re: [PATCH net] ipmr: Fix skb headroom in ipmr_get_route().

From: Guillaume Nault <gnault@...hat.com>
Date: Fri, 15 Nov 2019 18:29:52 +0100

> In route.c, inet_rtm_getroute_build_skb() creates an skb with no
> headroom. This skb is then used by inet_rtm_getroute() which may pass
> it to rt_fill_info() and, from there, to ipmr_get_route(). The later
> might try to reuse this skb by cloning it and prepending an IPv4
> header. But since the original skb has no headroom, skb_push() triggers
> skb_under_panic():
 ...
> Actually the original skb used to have enough headroom, but the
> reserve_skb() call was lost with the introduction of
> inet_rtm_getroute_build_skb() by commit 404eb77ea766 ("ipv4: support
> sport, dport and ip_proto in RTM_GETROUTE").
> 
> We could reserve some headroom again in inet_rtm_getroute_build_skb(),
> but this function shouldn't be responsible for handling the special
> case of ipmr_get_route(). Let's handle that directly in
> ipmr_get_route() by calling skb_realloc_headroom() instead of
> skb_clone().
> 
> Fixes: 404eb77ea766 ("ipv4: support sport, dport and ip_proto in RTM_GETROUTE")
> Signed-off-by: Guillaume Nault <gnault@...hat.com>

Applied and queued up for -stable.