All of lore.kernel.org
 help / color / mirror / Atom feed
From: William Tu <u9012063@gmail.com>
To: Prashant Bhole <bhole_prashant_q7@lab.ntt.co.jp>
Cc: "David S . Miller" <davem@davemloft.net>,
	Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>,
	Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>,
	Linux Kernel Network Developers <netdev@vger.kernel.org>
Subject: Re: [PATCH net-next] net: ip6_gre: get ipv6hdr after skb_cow_head()
Date: Fri, 13 Jul 2018 15:39:43 -0700	[thread overview]
Message-ID: <CALDO+SaBrnE2rvnCw61J=eTE-h5ahKr7TZ5kznhZR08w6bs2Cw@mail.gmail.com> (raw)
In-Reply-To: <20180713054050.5656-1-bhole_prashant_q7@lab.ntt.co.jp>

On Thu, Jul 12, 2018 at 10:40 PM, Prashant Bhole
<bhole_prashant_q7@lab.ntt.co.jp> wrote:
> A KASAN:use-after-free bug was found related to ip6-erspan
> while running selftests/net/ip6_gre_headroom.sh
>
> It happens because of following sequence:
> - ipv6hdr pointer is obtained from skb
> - skb_cow_head() is called, skb->head memory is reallocated
> - old data is accessed using ipv6hdr pointer
>
> skb_cow_head() call was added in e41c7c68ea77 ("ip6erspan: make sure
> enough headroom at xmit."), but looking at the history there was a
> chance of similar bug because gre_handle_offloads() and pskb_trim()
> can also reallocate skb->head memory. Fixes tag points to commit
> which introduced possibility of this bug.
>
> This patch moves ipv6hdr pointer assignment after skb_cow_head() call.
>
> Fixes: 5a963eb61b7c ("ip6_gre: Add ERSPAN native tunnel support")
> Signed-off-by: Prashant Bhole <bhole_prashant_q7@lab.ntt.co.jp>
> ---

Thanks for the fix.
Acked-by: William Tu <u9012063@gmail.com>

  parent reply	other threads:[~2018-07-13 22:57 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-07-13  5:40 [PATCH net-next] net: ip6_gre: get ipv6hdr after skb_cow_head() Prashant Bhole
2018-07-13 20:45 ` Gregory Rose
2018-07-13 22:39 ` William Tu [this message]
2018-07-16 20:40 ` David Miller

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to='CALDO+SaBrnE2rvnCw61J=eTE-h5ahKr7TZ5kznhZR08w6bs2Cw@mail.gmail.com' \
    --to=u9012063@gmail.com \
    --cc=bhole_prashant_q7@lab.ntt.co.jp \
    --cc=davem@davemloft.net \
    --cc=kuznet@ms2.inr.ac.ru \
    --cc=netdev@vger.kernel.org \
    --cc=yoshfuji@linux-ipv6.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.