Subject: Re: [BUG] kernel stack corruption during/after Netlabel error

From: James Morris <[email-masked]>
Date: Thu, 30 Nov 2017 10:41:29 +1100 (AEDT)

On Wed, 29 Nov 2017, Eric Dumazet wrote:

> On Wed, 2017-11-29 at 12:23 -0800, Eric Dumazet wrote:
> > 
> > I suspect this exposes an ancient bug, caused by fact that TCP moves
> > IP[6]CB in skb->cb[]
> > 
> > Basically the 2nd tcp_filter() added in commit
> > 8fac365f63c866a00015fa13932d8ffc584518b8
> > ("tcp: Add a tcp_filter hook before handle ack packet") was not
> > expecting selinux code being called a 2nd time,
> > while skb->cb[] has been mangled [1]
> > 
> > [1]
> > memmove(&TCP_SKB_CB(skb)->header.h4, IPCB(skb),
> >     sizeof(struct inet_skb_parm));
> 
> Please try this fix for IPv4 (a similar patch will be needed for IPv6)
> 
>  net/ipv4/tcp_ipv4.c |   51 ++++++++++++++++++++++++++----------------
>  1 file changed, 32 insertions(+), 19 deletions(-)

Works for me, no crashes with the testsuite running in a loop.

Tested-by: James Morris <[email-masked]>

-- 
James Morris
<[email-masked]>