Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1532468

Re: net: GPF in eth_header

From Eric Dumazet <eric.dumazet@gmail.com>
Newsgroups linux.kernel
Subject Re: net: GPF in eth_header
Date 2016-11-29 17:20 +0100
Message-ID <sITip-2kT-21@gated-at.bofh.it> (permalink)
References (2 earlier) <sHQwi-2dp-13@gated-at.bofh.it> <sHRsl-2MG-5@gated-at.bofh.it> <sINPH-7eO-1@gated-at.bofh.it> <sIS31-1lb-59@gated-at.bofh.it> <sISFI-1NU-3@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

On Tue, 2016-11-29 at 16:31 +0100, Andrey Konovalov wrote:
=
> The issue is not with skb_network_offset(), but with __skb_pull()
> using skb_network_offset() as an argument.
> 

No. The issue can happen with _any_ __skb_pull() with a 'negative'
argument, on 64bit arches.

skb_network_offset() is only one of the many cases this could happen if
a bug is added at some random place, including memory corruption from
a different kernel layer, or buggy hardware.

> I'm not sure what would be the beast way to fix this, to add a check
> before every __skb_pull(skb_network_offset()), to fix __skb_pull() to
> work with signed ints, to add BUG_ON()'s in __skb_pull, or something
> else.
> 
> What I meant is that you fixed this very instance of the bug, and I'm
> pointing out that a similar one might hit us again.

As I said, adding a check in skb_network_offset() would not be generic
enough.

Sure, we can be proactive and add tests everywhere in the kernel, but we
also want to keep it reasonably fast.

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

net: GPF in eth_header Dmitry Vyukov <dvyukov@google.com> - 2016-11-26 18:40 +0100
  Re: net: GPF in eth_header Eric Dumazet <edumazet@google.com> - 2016-11-26 19:30 +0100
    Re: net: GPF in eth_header Andrey Konovalov <andreyknvl@google.com> - 2016-11-26 20:10 +0100
      Re: net: GPF in eth_header Eric Dumazet <erdlkml@gmail.com> - 2016-11-26 21:10 +0100
        Re: net: GPF in eth_header Eric Dumazet <erdlkml@gmail.com> - 2016-11-26 21:40 +0100
        Re: net: GPF in eth_header Andrey Konovalov <andreyknvl@google.com> - 2016-11-29 11:30 +0100
          Re: net: GPF in eth_header Eric Dumazet <eric.dumazet@gmail.com> - 2016-11-29 16:00 +0100
            Re: net: GPF in eth_header Andrey Konovalov <andreyknvl@google.com> - 2016-11-29 16:40 +0100
              Re: net: GPF in eth_header Eric Dumazet <eric.dumazet@gmail.com> - 2016-11-29 17:20 +0100
      Re: net: GPF in eth_header Eric Dumazet <eric.dumazet@gmail.com> - 2016-11-28 20:00 +0100
        Re: net: GPF in eth_header Andrey Konovalov <andreyknvl@google.com> - 2016-11-28 20:10 +0100
          Re: net: GPF in eth_header Dmitry Vyukov <dvyukov@google.com> - 2016-11-28 20:40 +0100
            Re: net: GPF in eth_header Eric Dumazet <eric.dumazet@gmail.com> - 2016-11-28 20:50 +0100
              Re: net: GPF in eth_header Eric Dumazet <eric.dumazet@gmail.com> - 2016-11-28 22:10 +0100
                Re: net: GPF in eth_header Eric Dumazet <eric.dumazet@gmail.com> - 2016-11-28 22:20 +0100
                Re: net: GPF in eth_header Florian Westphal <fw@strlen.de> - 2016-11-28 22:40 +0100
                Re: net: GPF in eth_header Eric Dumazet <eric.dumazet@gmail.com> - 2016-11-28 23:20 +0100
                Re: net: GPF in eth_header Florian Westphal <fw@strlen.de> - 2016-11-28 23:30 +0100
                Re: net: GPF in eth_header Eric Dumazet <eric.dumazet@gmail.com> - 2016-11-29 00:20 +0100

csiph-web