lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <yi6goqhyxkh4slmje6a37vlrxby2qmzg66wgdzrzgt55wgpvdy@d3b7jucayzxv> Date: Tue, 28 Mar 2023 11:23:16 +0200 From: Stefano Garzarella <sgarzare@...hat.com> To: Arseniy Krasnov <avkrasnov@...rdevices.ru> Cc: Stefan Hajnoczi <stefanha@...hat.com>, "David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, Bobby Eshleman <bobby.eshleman@...edance.com>, kvm@...r.kernel.org, virtualization@...ts.linux-foundation.org, netdev@...r.kernel.org, linux-kernel@...r.kernel.org, kernel@...rdevices.ru, oxffffaa@...il.com Subject: Re: [RFC PATCH v2 1/3] virtio/vsock: fix header length on skb merging On Sun, Mar 26, 2023 at 01:08:22AM +0300, Arseniy Krasnov wrote: >This fixes appending newly arrived skbuff to the last skbuff of the >socket's queue. Problem fires when we are trying to append data to skbuff >which was already processed in dequeue callback at least once. Dequeue >callback calls function 'skb_pull()' which changes 'skb->len'. In current >implementation 'skb->len' is used to update length in header of the last >skbuff after new data was copied to it. This is bug, because value in >header is used to calculate 'rx_bytes'/'fwd_cnt' and thus must be not >be changed during skbuff's lifetime. > >Bug starts to fire since: > >commit 077706165717 >("virtio/vsock: don't use skbuff state to account credit") > >It presents before, but didn't triggered due to a little bit buggy >implementation of credit calculation logic. So use Fixes tag for it. > >Fixes: 077706165717 ("virtio/vsock: don't use skbuff state to account credit") >Signed-off-by: Arseniy Krasnov <AVKrasnov@...rdevices.ru> >--- > net/vmw_vsock/virtio_transport_common.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > >diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c >index 7fc178c3ee07..b9144af71553 100644 >--- a/net/vmw_vsock/virtio_transport_common.c >+++ b/net/vmw_vsock/virtio_transport_common.c >@@ -1101,7 +1101,7 @@ virtio_transport_recv_enqueue(struct vsock_sock *vsk, > memcpy(skb_put(last_skb, skb->len), skb->data, skb->len); > free_pkt = true; > last_hdr->flags |= hdr->flags; >- last_hdr->len = cpu_to_le32(last_skb->len); >+ le32_add_cpu(&last_hdr->len, len); > goto out; > } > } >-- >2.25.1 > LGTM! Reviewed-by: Stefano Garzarella <sgarzare@...hat.com>
Powered by blists - more mailing lists