From: Eric Dumazet <eric.dumazet@gmail•com>
To: Eric Dumazet <edumazet@google•com>,
syzbot <syzbot+71d74a5406d02057d559@syzkaller•appspotmail.com>
Cc: alexander.deucher@amd•com,
Andrey Konovalov <andreyknvl@google•com>,
Anoob Soman <anoob.soman@citrix•com>,
chris@chris-wilson•co.uk, David Miller <davem@davemloft•net>,
elena.reshetova@intel•com,
Greg Kroah-Hartman <gregkh@linuxfoundation•org>,
Kees Cook <keescook@chromium•org>,
LKML <linux-kernel@vger•kernel.org>,
Mike Maloney <maloney@google•com>,
mchehab@kernel•org, netdev <netdev@vger•kernel.org>,
rami.rosen@intel•com,
Sowmini Varadhan <sowmini.varadhan@oracle•com>,
syzkaller-bugs@googlegroups•com,
Willem de Bruijn <willemb@google•com>
Subject: Re: KASAN: use-after-free Read in __dev_queue_xmit
Date: Wed, 03 Jan 2018 22:53:14 -0800 [thread overview]
Message-ID: <1515048794.131759.4.camel@gmail.com> (raw)
In-Reply-To: <CANn89iLEt2e0X-zj0f_05R-oN7sX7fKUWbNz_DJSeKXJMSwUBQ@mail.gmail.com>
On Wed, 2018-01-03 at 21:13 -0800, Eric Dumazet wrote:
> Note: all commands must start from beginning of the line in the email body.
>
> I guess skb_probe_transport_header() should be hardened to reject malicious
> packets given by user space, instead of being gentle.
Although bug triggered for this particular repro is in flow dissector
:/
I will test :
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 15ce300637650e17fcab7e378b20fe7972686d46..544bddf08e13c7f6e47aadc737244c9ba5af56b2 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -976,8 +976,8 @@ bool __skb_flow_dissect(const struct sk_buff *skb,
out_good:
ret = true;
- key_control->thoff = (u16)nhoff;
out:
+ key_control->thoff = min_t(u16, nhoff, skb ? skb->len : hlen);
key_basic->n_proto = proto;
key_basic->ip_proto = ip_proto;
@@ -985,7 +985,6 @@ bool __skb_flow_dissect(const struct sk_buff *skb,
out_bad:
ret = false;
- key_control->thoff = min_t(u16, nhoff, skb ? skb->len : hlen);
goto out;
}
EXPORT_SYMBOL(__skb_flow_dissect);
next prev parent reply other threads:[~2018-01-04 6:53 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-01-04 4:58 KASAN: use-after-free Read in __dev_queue_xmit syzbot
2018-01-04 5:13 ` Eric Dumazet
2018-01-04 6:53 ` Eric Dumazet [this message]
2018-05-09 7:37 ` Eric Biggers
2018-05-09 16:11 ` Willem de Bruijn
2018-05-09 16:38 ` Willem de Bruijn
2018-05-09 19:21 ` Willem de Bruijn
2018-05-09 19:36 ` Eric Dumazet
2018-05-09 21:05 ` Willem de Bruijn
2018-05-10 21:49 ` Willem de Bruijn
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1515048794.131759.4.camel@gmail.com \
--to=eric.dumazet@gmail$(echo .)com \
--cc=alexander.deucher@amd$(echo .)com \
--cc=andreyknvl@google$(echo .)com \
--cc=anoob.soman@citrix$(echo .)com \
--cc=chris@chris-wilson$(echo .)co.uk \
--cc=davem@davemloft$(echo .)net \
--cc=edumazet@google$(echo .)com \
--cc=elena.reshetova@intel$(echo .)com \
--cc=gregkh@linuxfoundation$(echo .)org \
--cc=keescook@chromium$(echo .)org \
--cc=linux-kernel@vger$(echo .)kernel.org \
--cc=maloney@google$(echo .)com \
--cc=mchehab@kernel$(echo .)org \
--cc=netdev@vger$(echo .)kernel.org \
--cc=rami.rosen@intel$(echo .)com \
--cc=sowmini.varadhan@oracle$(echo .)com \
--cc=syzbot+71d74a5406d02057d559@syzkaller$(echo .)appspotmail.com \
--cc=syzkaller-bugs@googlegroups$(echo .)com \
--cc=willemb@google$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox