netdev - Re: [PATCH net] ipv6: fix typos in __ip6_finish

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <e48ceee7-b101-44f3-1bbc-6fbcdf9194db@gmail.com>
Date:   Thu, 18 Nov 2021 20:48:17 -0700
From:   David Ahern <dsahern@...il.com>
To:     Eric Dumazet <eric.dumazet@...il.com>,
        "David S . Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>
Cc:     netdev <netdev@...r.kernel.org>,
        Eric Dumazet <edumazet@...gle.com>,
        Tobias Brunner <tobias@...ongswan.org>,
        Steffen Klassert <steffen.klassert@...unet.com>,
        David Ahern <dsahern@...nel.org>
Subject: Re: [PATCH net] ipv6: fix typos in __ip6_finish_output()

On 11/18/21 6:37 PM, Eric Dumazet wrote:
> From: Eric Dumazet <edumazet@...gle.com>
> 
> We deal with IPv6 packets, so we need to use IP6CB(skb)->flags and
> IP6SKB_REROUTED, instead of IPCB(skb)->flags and IPSKB_REROUTED
> 
> Found by code inspection, please double check that fixing this bug
> does not surface other bugs.
> 
> Fixes: 09ee9dba9611 ("ipv6: Reinject IPv6 packets if IPsec policy matches after SNAT")
> Signed-off-by: Eric Dumazet <edumazet@...gle.com>
> Cc: Tobias Brunner <tobias@...ongswan.org>
> Cc: Steffen Klassert <steffen.klassert@...unet.com>
> Cc: David Ahern <dsahern@...nel.org>
> ---
>  net/ipv6/ip6_output.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
> index 2f044a49afa8cf3586c36607c34073edecafc69c..ff4e83e2a5068322bb93391c7c5e2a8cb932730b 100644
> --- a/net/ipv6/ip6_output.c
> +++ b/net/ipv6/ip6_output.c
> @@ -174,7 +174,7 @@ static int __ip6_finish_output(struct net *net, struct sock *sk, struct sk_buff
>  #if defined(CONFIG_NETFILTER) && defined(CONFIG_XFRM)
>  	/* Policy lookup after SNAT yielded a new policy */
>  	if (skb_dst(skb)->xfrm) {
> -		IPCB(skb)->flags |= IPSKB_REROUTED;
> +		IP6CB(skb)->flags |= IP6SKB_REROUTED;
>  		return dst_output(net, sk, skb);
>  	}
>  #endif
> 

How did that even work - the flags are at different offsets.

VRF driver has the same mistake in vrf_output6_direct (I followed ipv6
code back when and did not pick up on the mistake). prepare_ipv6_hdr in
rxe_net.c has a similar style mistake.

Reviewed-by: David Ahern <dsahern@...nel.org>