Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1530773

Re: net: GPF in eth_header

Show all headers | View raw

> Hi Eric,
>
> The crash happens when the kernel tries to access shadow for nonmapped memory.
>
> The issue here is an integer overflow which happens in neigh_resolve_output().
> skb_network_offset(skb) can return negative number, but __skb_pull()
> accepts unsigned int as len.
> As a result, the least significat bit in higher 32 bits of skb->data
> gets set and we get an out-of-bounds with offset of 4 GB.
>
> I've attached a short reproducer, but you either need KASAN or to add
> a BUG_ON to see the crash.
> In this reproducer skb_network_offset() becomes negative after merging
> two ipv6 fragments.
>
> I actually see multiple places where skb_network_offset() is used as
> an argument to skb_pull().
> So I guess every place can potentially be buggy.

Well, I think the intent is to accept a negative number.

This definitely was assumed by commit e1f165032c8bade authors !

I guess they were using a 32bit kernel for their tests.

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

net: GPF in eth_header Dmitry Vyukov <dvyukov@google.com> - 2016-11-26 18:40 +0100
  Re: net: GPF in eth_header Eric Dumazet <edumazet@google.com> - 2016-11-26 19:30 +0100
    Re: net: GPF in eth_header Andrey Konovalov <andreyknvl@google.com> - 2016-11-26 20:10 +0100
      Re: net: GPF in eth_header Eric Dumazet <erdlkml@gmail.com> - 2016-11-26 21:10 +0100
        Re: net: GPF in eth_header Eric Dumazet <erdlkml@gmail.com> - 2016-11-26 21:40 +0100
        Re: net: GPF in eth_header Andrey Konovalov <andreyknvl@google.com> - 2016-11-29 11:30 +0100
          Re: net: GPF in eth_header Eric Dumazet <eric.dumazet@gmail.com> - 2016-11-29 16:00 +0100
            Re: net: GPF in eth_header Andrey Konovalov <andreyknvl@google.com> - 2016-11-29 16:40 +0100
              Re: net: GPF in eth_header Eric Dumazet <eric.dumazet@gmail.com> - 2016-11-29 17:20 +0100
      Re: net: GPF in eth_header Eric Dumazet <eric.dumazet@gmail.com> - 2016-11-28 20:00 +0100
        Re: net: GPF in eth_header Andrey Konovalov <andreyknvl@google.com> - 2016-11-28 20:10 +0100
          Re: net: GPF in eth_header Dmitry Vyukov <dvyukov@google.com> - 2016-11-28 20:40 +0100
            Re: net: GPF in eth_header Eric Dumazet <eric.dumazet@gmail.com> - 2016-11-28 20:50 +0100
              Re: net: GPF in eth_header Eric Dumazet <eric.dumazet@gmail.com> - 2016-11-28 22:10 +0100
                Re: net: GPF in eth_header Eric Dumazet <eric.dumazet@gmail.com> - 2016-11-28 22:20 +0100
                Re: net: GPF in eth_header Florian Westphal <fw@strlen.de> - 2016-11-28 22:40 +0100
                Re: net: GPF in eth_header Eric Dumazet <eric.dumazet@gmail.com> - 2016-11-28 23:20 +0100
                Re: net: GPF in eth_header Florian Westphal <fw@strlen.de> - 2016-11-28 23:30 +0100
                Re: net: GPF in eth_header Eric Dumazet <eric.dumazet@gmail.com> - 2016-11-29 00:20 +0100

csiph-web