From: Eric Dumazet <eric.dumazet@gmail.com>
To: Florian Westphal <fw@strlen.de>
Cc: Dmitry Vyukov <dvyukov@google.com>,
syzkaller <syzkaller@googlegroups.com>,
Hannes Frederic Sowa <hannes@stressinduktion.org>,
David Miller <davem@davemloft.net>,
Tom Herbert <tom@herbertland.com>,
Alexander Duyck <aduyck@mirantis.com>,
Jiri Benc <jbenc@redhat.com>,
Sabrina Dubroca <sd@queasysnail.net>,
netdev <netdev@vger.kernel.org>,
LKML <linux-kernel@vger.kernel.org>
Subject: Re: net: GPF in eth_header
Date: Mon, 28 Nov 2016 14:14:04 -0800 [thread overview]
Message-ID: <1480371244.18162.91.camel@edumazet-glaptop3.roam.corp.google.com> (raw)
In-Reply-To: <20161128213444.GA9858@breakpoint.cc>
On Mon, 2016-11-28 at 22:34 +0100, Florian Westphal wrote:
> Eric Dumazet <eric.dumazet@gmail.com> wrote:
> > > Might be a bug added in commit daaa7d647f81f3
> > > ("netfilter: ipv6: avoid nf_iterate recursion")
> > >
> > > Florian, what do you think of dropping a packet that presumably was
> > > mangled badly by nf_ct_frag6_queue() ?
>
> ipv4 definitely frees malformed packets.
> In general, I think netfilter should avoid 'silent' drops if possible
> and let skb continue, but of course such skbs should not be made worse
> as what we ate to begin with...
>
> > > (Like about 48 byte pulled :(, and/or skb->csum changed )
>
> I think this warrants a review of ipv6 reassembly too, bug reported here
> is because ipv6 nf defrag is also done on output.
ip6_frag_queue() definitely frees bad/mangled skbs()
> Looks good, we'll need to change some of the errno return codes in
> nf_ct_frag6_gather to 0 though for this to work, which should not be too
> hard ;)
If the goal is to let buggy packets pass, then we might need to undo
changes in nf_ct_frag6_queue()
next prev parent reply other threads:[~2016-11-28 22:15 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-11-26 17:30 net: GPF in eth_header Dmitry Vyukov
2016-11-26 18:28 ` Eric Dumazet
2016-11-26 19:07 ` Andrey Konovalov
2016-11-26 20:05 ` Eric Dumazet
2016-11-26 20:34 ` Eric Dumazet
2016-11-29 10:26 ` Andrey Konovalov
2016-11-29 14:58 ` Eric Dumazet
2016-11-29 15:31 ` Andrey Konovalov
2016-11-29 16:15 ` Eric Dumazet
2016-11-28 18:50 ` Eric Dumazet
2016-11-28 19:04 ` Andrey Konovalov
2016-11-28 19:34 ` Dmitry Vyukov
2016-11-28 19:47 ` Eric Dumazet
2016-11-28 21:05 ` Eric Dumazet
2016-11-28 21:18 ` Eric Dumazet
2016-11-28 21:34 ` Florian Westphal
2016-11-28 22:14 ` Eric Dumazet [this message]
2016-11-28 22:19 ` Florian Westphal
2016-11-28 23:16 ` Eric Dumazet
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1480371244.18162.91.camel@edumazet-glaptop3.roam.corp.google.com \
--to=eric.dumazet@gmail.com \
--cc=aduyck@mirantis.com \
--cc=davem@davemloft.net \
--cc=dvyukov@google.com \
--cc=fw@strlen.de \
--cc=hannes@stressinduktion.org \
--cc=jbenc@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=sd@queasysnail.net \
--cc=syzkaller@googlegroups.com \
--cc=tom@herbertland.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.