Patchwork [1/2,net] 6lowpan: add missing pskb_may_pull() check

login
register
mail settings
Submitter alex.bluesman.smirnov@gmail.com
Date May 10, 2012, 1:22 p.m.
Message ID <4fabc166.9208cc0a.4de8.ffff9211@mx.google.com>
Download mbox | patch
Permalink /patch/158288/
State Changes Requested
Delegated to: David Miller
Headers show

Comments

alex.bluesman.smirnov@gmail.com - May 10, 2012, 1:22 p.m.
From: Alexander Smirnov <alex.bluesman.smirnov@gmail.com>

Add pskb_may_pull() call when fetching u8 from skb.

Signed-off-by: Alexander Smirnov <alex.bluesman.smirnov@gmail.com>
---
 net/ieee802154/6lowpan.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)
Eric Dumazet - May 10, 2012, 1:30 p.m.
On Thu, 2012-05-10 at 17:22 +0400, alex.bluesman.smirnov@gmail.com
wrote:
> From: Alexander Smirnov <alex.bluesman.smirnov@gmail.com>
> 
> Add pskb_may_pull() call when fetching u8 from skb.
> 
> Signed-off-by: Alexander Smirnov <alex.bluesman.smirnov@gmail.com>
> ---
>  net/ieee802154/6lowpan.c |    2 ++
>  1 files changed, 2 insertions(+), 0 deletions(-)
> 
> diff --git a/net/ieee802154/6lowpan.c b/net/ieee802154/6lowpan.c
> index 32eb417..0ab3efe 100644
> --- a/net/ieee802154/6lowpan.c
> +++ b/net/ieee802154/6lowpan.c
> @@ -295,6 +295,8 @@ static u8 lowpan_fetch_skb_u8(struct sk_buff *skb)
>  {
>  	u8 ret;
>  
> +	BUG_ON(!pskb_may_pull(skb, 1));
> +
>  	ret = skb->data[0];
>  	skb_pull(skb, 1);
>  

No, you cant do that.

pskb_may_pull() can fail, and you crash your machine instead of graceful
error reporting.



--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
alex.bluesman.smirnov@gmail.com - May 10, 2012, 2:05 p.m.
Hi Eric,

2012/5/10 Eric Dumazet <eric.dumazet@gmail.com>:
> On Thu, 2012-05-10 at 17:22 +0400, alex.bluesman.smirnov@gmail.com
> wrote:
>> From: Alexander Smirnov <alex.bluesman.smirnov@gmail.com>
>>
>> Add pskb_may_pull() call when fetching u8 from skb.
>>
>> Signed-off-by: Alexander Smirnov <alex.bluesman.smirnov@gmail.com>
>> ---
>>  net/ieee802154/6lowpan.c |    2 ++
>>  1 files changed, 2 insertions(+), 0 deletions(-)
>>
>> diff --git a/net/ieee802154/6lowpan.c b/net/ieee802154/6lowpan.c
>> index 32eb417..0ab3efe 100644
>> --- a/net/ieee802154/6lowpan.c
>> +++ b/net/ieee802154/6lowpan.c
>> @@ -295,6 +295,8 @@ static u8 lowpan_fetch_skb_u8(struct sk_buff *skb)
>>  {
>>       u8 ret;
>>
>> +     BUG_ON(!pskb_may_pull(skb, 1));
>> +
>>       ret = skb->data[0];
>>       skb_pull(skb, 1);
>>
>
> No, you cant do that.
>
> pskb_may_pull() can fail, and you crash your machine instead of graceful
> error reporting.
>

thanks for the comment!

Using BUG() macro I just want to indicate that something in the bottom
of the stack went terribly wrong and you must check your code for
bugs..

>
>
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
David Miller - May 10, 2012, 4:28 p.m.
From: Alexander Smirnov <alex.bluesman.smirnov@gmail.com>
Date: Thu, 10 May 2012 18:05:46 +0400

> Using BUG() macro I just want to indicate that something in the bottom
> of the stack went terribly wrong and you must check your code for
> bugs..

Then you should do something like:

	if (WARN_ON_ONCE(!pskb_may_pull(...))) {
		appropriate_error_handling();
		return;
	}

instead.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch

diff --git a/net/ieee802154/6lowpan.c b/net/ieee802154/6lowpan.c
index 32eb417..0ab3efe 100644
--- a/net/ieee802154/6lowpan.c
+++ b/net/ieee802154/6lowpan.c
@@ -295,6 +295,8 @@  static u8 lowpan_fetch_skb_u8(struct sk_buff *skb)
 {
 	u8 ret;
 
+	BUG_ON(!pskb_may_pull(skb, 1));
+
 	ret = skb->data[0];
 	skb_pull(skb, 1);