netdev - Re: [PATCH net] net: psample: fix skb_over

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20191126.144131.1380494669149571889.davem@davemloft.net>
Date:   Tue, 26 Nov 2019 14:41:31 -0800 (PST)
From:   David Miller <davem@...emloft.net>
To:     nikolay@...ulusnetworks.com
Cc:     netdev@...r.kernel.org, yotamg@...lanox.com, jiri@...lanox.com,
        jhs@...atatu.com, simon.horman@...ronome.com,
        roopa@...ulusnetworks.com
Subject: Re: [PATCH net] net: psample: fix skb_over_panic

From: Nikolay Aleksandrov <nikolay@...ulusnetworks.com>
Date: Wed, 27 Nov 2019 00:16:44 +0200

> We need to calculate the skb size correctly otherwise we risk triggering
> skb_over_panic[1]. The issue is that data_len is added to the skb in a
> nl attribute, but we don't account for its header size (nlattr 4 bytes)
> and alignment. We account for it when calculating the total size in
> the > PSAMPLE_MAX_PACKET_SIZE comparison correctly, but not when
> allocating after that. The fix is simple - use nla_total_size() for
> data_len when allocating.
> 
> To reproduce:
>  $ tc qdisc add dev eth1 clsact
>  $ tc filter add dev eth1 egress matchall action sample rate 1 group 1 trunc 129
>  $ mausezahn eth1 -b bcast -a rand -c 1 -p 129
>  < skb_over_panic BUG(), tail is 4 bytes past skb->end >
> 
> [1] Trace:
 ...
> CC: Yotam Gigi <yotamg@...lanox.com>
> CC: Jiri Pirko <jiri@...lanox.com>
> CC: Jamal Hadi Salim <jhs@...atatu.com>
> CC: Simon Horman <simon.horman@...ronome.com>
> CC: Roopa Prabhu <roopa@...ulusnetworks.com>
> Fixes: 6ae0a6286171 ("net: Introduce psample, a new genetlink channel for packet sampling")
> Signed-off-by: Nikolay Aleksandrov <nikolay@...ulusnetworks.com>

Applied and queued up for -stable, thanks.