netdev - Re: [PATCHv3 net] bonding: fix ICMPv6 header handling when receiving IPv6 messages

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <22985.1668659398@famine>
Date:   Wed, 16 Nov 2022 20:29:58 -0800
From:   Jay Vosburgh <jay.vosburgh@...onical.com>
To:     Hangbin Liu <liuhangbin@...il.com>
cc:     "David S . Miller" <davem@...emloft.net>,
        Eric Dumazet <eric.dumazet@...il.com>, netdev@...r.kernel.org,
        Jakub Kicinski <kuba@...nel.org>,
        Jonathan Toppins <jtoppins@...hat.com>,
        Paolo Abeni <pabeni@...hat.com>,
        David Ahern <dsahern@...il.com>, Liang Li <liali@...hat.com>,
        David Ahern <dsahern@...nel.org>
Subject: Re: [PATCHv3 net] bonding: fix ICMPv6 header handling when receiving IPv6 messages

Hangbin Liu <liuhangbin@...il.com> wrote:

>On Wed, Nov 16, 2022 at 07:16:14AM -0800, Jay Vosburgh wrote:
[...]
>> 	The above comment is from Eric.  I had also mentioned that this
>> particular problem already existed in the code being patched.
>
>Yes, I also saw your comments. I was thinking to fix this issue separately.
>i.e. in bond_rcv_validate(). With this we can check both IPv6 header and ARP
>header. e.g.
>
>diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
>index 2c6356232668..ae4c30a25b76 100644
>--- a/drivers/net/bonding/bond_main.c
>+++ b/drivers/net/bonding/bond_main.c
>@@ -3278,8 +3278,10 @@ int bond_rcv_validate(const struct sk_buff *skb, struct bonding *bond,
> {
> #if IS_ENABLED(CONFIG_IPV6)
> 	bool is_ipv6 = skb->protocol == __cpu_to_be16(ETH_P_IPV6);
>+	struct ipv6hdr ip6_hdr;
> #endif
> 	bool is_arp = skb->protocol == __cpu_to_be16(ETH_P_ARP);
>+	struct arphdr arp_hdr;
> 
> 	slave_dbg(bond->dev, slave->dev, "%s: skb->dev %s\n",
> 		  __func__, skb->dev->name);
>@@ -3293,10 +3295,10 @@ int bond_rcv_validate(const struct sk_buff *skb, struct bonding *bond,
> 		    !slave_do_arp_validate_only(bond))
> 			slave->last_rx = jiffies;
> 		return RX_HANDLER_ANOTHER;
>-	} else if (is_arp) {
>+	} else if (is_arp && skb_header_pointer(skb, 0, sizeof(arp_hdr), &arp_hdr)) {
> 		return bond_arp_rcv(skb, bond, slave);
> #if IS_ENABLED(CONFIG_IPV6)
>-	} else if (is_ipv6) {
>+	} else if (is_ipv6 && skb_header_pointer(skb, 0, sizeof(ip6_hdr), &ip6_hdr)) {
> 		return bond_na_rcv(skb, bond, slave);
> #endif
> 	} else {
>
>What do you think?

	I don't see how this solves the icmp6_hdr() / ipv6_hdr() problem
in bond_na_rcv(); skb_header_pointer() doesn't do a pull, it just copies
into the supplied struct (if necessary).

	-J

---
	-Jay Vosburgh, jay.vosburgh@...onical.com