netdev - Re: [PATCH net v2] net: gso: fix panic on frag

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 04 Nov 2022 04:10:16 +0000
From:   patchwork-bot+netdevbpf@...nel.org
To:     Jiri Benc <jbenc@...hat.com>
Cc:     netdev@...r.kernel.org, shmulik@...anetworks.com,
        eric.dumazet@...il.com, tomas@...era.io,
        jpiotrowski@...ux.microsoft.com, kuba@...nel.org,
        willemdebruijn.kernel@...il.com
Subject: Re: [PATCH net v2] net: gso: fix panic on frag_list with mixed head alloc
 types

Hello:

This patch was applied to netdev/net.git (master)
by Jakub Kicinski <kuba@...nel.org>:

On Wed,  2 Nov 2022 17:53:25 +0100 you wrote:
> Since commit 3dcbdb134f32 ("net: gso: Fix skb_segment splat when
> splitting gso_size mangled skb having linear-headed frag_list"), it is
> allowed to change gso_size of a GRO packet. However, that commit assumes
> that "checking the first list_skb member suffices; i.e if either of the
> list_skb members have non head_frag head, then the first one has too".
> 
> It turns out this assumption does not hold. We've seen BUG_ON being hit
> in skb_segment when skbs on the frag_list had differing head_frag with
> the vmxnet3 driver. This happens because __netdev_alloc_skb and
> __napi_alloc_skb can return a skb that is page backed or kmalloced
> depending on the requested size. As the result, the last small skb in
> the GRO packet can be kmalloced.
> 
> [...]

Here is the summary with links:
  - [net,v2] net: gso: fix panic on frag_list with mixed head alloc types
    https://git.kernel.org/netdev/net/c/9e4b7a99a03a

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html