diff mbox

netfilter: fix unaligned memory access in tcp_sack

Message ID 878wmx3pfk.fsf@netris.org
State Not Applicable, archived
Delegated to: David Miller
Headers show

Commit Message

Mark H. Weaver March 23, 2009, 3:09 a.m. UTC
This patch fixes an unaligned memory access in tcp_sack while reading
sequence numbers from TCP selective acknowledgement options.  Prior to
applying this patch, upstream linux-2.6.27.20 was occasionally
generating messages like this on my sparc64 system:

  [54678.532071] Kernel unaligned access at TPC[6b17d4] tcp_packet+0xcd4/0xd00

More details provided upon request.  Apologies in advance if I've sent
this to the wrong place or not followed proper procedures.

   Best,
    Mark


--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Comments

David Miller March 23, 2009, 4:17 a.m. UTC | #1
From: "Mark H. Weaver" <mhw@netris.org>
Date: Sun, 22 Mar 2009 23:09:51 -0400

> This patch fixes an unaligned memory access in tcp_sack while reading
> sequence numbers from TCP selective acknowledgement options.  Prior to
> applying this patch, upstream linux-2.6.27.20 was occasionally
> generating messages like this on my sparc64 system:
> 
>   [54678.532071] Kernel unaligned access at TPC[6b17d4] tcp_packet+0xcd4/0xd00
> 
> More details provided upon request.  Apologies in advance if I've sent
> this to the wrong place or not followed proper procedures.

Acked-by: David S. Miller <davem@davemloft.net>
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Patrick McHardy March 23, 2009, 12:48 p.m. UTC | #2
David Miller wrote:
> From: "Mark H. Weaver" <mhw@netris.org>
> Date: Sun, 22 Mar 2009 23:09:51 -0400
> 
>> This patch fixes an unaligned memory access in tcp_sack while reading
>> sequence numbers from TCP selective acknowledgement options.  Prior to
>> applying this patch, upstream linux-2.6.27.20 was occasionally
>> generating messages like this on my sparc64 system:
>>
>>   [54678.532071] Kernel unaligned access at TPC[6b17d4] tcp_packet+0xcd4/0xd00
>>
>> More details provided upon request.  Apologies in advance if I've sent
>> this to the wrong place or not followed proper procedures.
> 
> Acked-by: David S. Miller <davem@davemloft.net>

Looks good to me. Dave, please apply directly or pull from:

git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-2.6.git

Thanks!
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
David Miller March 24, 2009, 11:39 p.m. UTC | #3
From: Patrick McHardy <kaber@trash.net>
Date: Mon, 23 Mar 2009 13:48:24 +0100

> Looks good to me. Dave, please apply directly or pull from:
> 
> git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-2.6.git

Pulled, thanks Patrick.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

--- linux-2.6/net/netfilter/nf_conntrack_proto_tcp.c.orig	2009-03-22 17:51:47.000000000 -0400
+++ linux-2.6/net/netfilter/nf_conntrack_proto_tcp.c	2009-03-22 22:49:23.000000000 -0400
@@ -15,6 +15,7 @@ 
 #include <linux/skbuff.h>
 #include <linux/ipv6.h>
 #include <net/ip6_checksum.h>
+#include <asm/unaligned.h>
 
 #include <net/tcp.h>
 
@@ -466,7 +467,7 @@  static void tcp_sack(const struct sk_buf
 				for (i = 0;
 				     i < (opsize - TCPOLEN_SACK_BASE);
 				     i += TCPOLEN_SACK_PERBLOCK) {
-					tmp = ntohl(*((__be32 *)(ptr+i)+1));
+					tmp = get_unaligned_be32((__be32 *)(ptr+i)+1);
 
 					if (after(tmp, *sack))
 						*sack = tmp;