| Message ID | 3274d7c98d7d5ea07058d8b73f987fc60b6e8b6c.1487612303.git.pabeni@redhat.com |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
On Tue, 2017-02-21 at 09:33 +0100, Paolo Abeni wrote: > The skbs processed by ip_cmsg_recv() are not guaranteed to > be linear e.g. when sending UDP packets over loopback with > MSGMORE. > Using csum_partial() on [potentially] the whole skb len > is dangerous; instead be on the safe side and use skb_checksum(). > > Thanks to syzkaller team to detect the issue and provide the > reproducer. Acked-by: Eric Dumazet <edumazet@google.com> Thanks Paolo !
From: Paolo Abeni <pabeni@redhat.com> Date: Tue, 21 Feb 2017 09:33:18 +0100 > The skbs processed by ip_cmsg_recv() are not guaranteed to > be linear e.g. when sending UDP packets over loopback with > MSGMORE. > Using csum_partial() on [potentially] the whole skb len > is dangerous; instead be on the safe side and use skb_checksum(). > > Thanks to syzkaller team to detect the issue and provide the > reproducer. > > v1 -> v2: > - move the variable declaration in a tighter scope > > Fixes: ad6f939ab193 ("ip: Add offset parameter to ip_cmsg_recv") > Reported-by: Andrey Konovalov <andreyknvl@google.com> > Signed-off-by: Paolo Abeni <pabeni@redhat.com> Applied and queued up for -stable, thanks.
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c index 9000117..fc4bf4d 100644 --- a/net/ipv4/ip_sockglue.c +++ b/net/ipv4/ip_sockglue.c @@ -116,10 +116,10 @@ static void ip_cmsg_recv_checksum(struct msghdr *msg, struct sk_buff *skb, if (skb->ip_summed != CHECKSUM_COMPLETE) return; - if (offset != 0) - csum = csum_sub(csum, - csum_partial(skb_transport_header(skb) + tlen, - offset, 0)); + if (offset != 0) { + int tend_off = skb_transport_offset(skb) + tlen; + csum = csum_sub(csum, skb_checksum(skb, tend_off, offset, 0)); + } put_cmsg(msg, SOL_IP, IP_CHECKSUM, sizeof(__wsum), &csum); }
The skbs processed by ip_cmsg_recv() are not guaranteed to be linear e.g. when sending UDP packets over loopback with MSGMORE. Using csum_partial() on [potentially] the whole skb len is dangerous; instead be on the safe side and use skb_checksum(). Thanks to syzkaller team to detect the issue and provide the reproducer. v1 -> v2: - move the variable declaration in a tighter scope Fixes: ad6f939ab193 ("ip: Add offset parameter to ip_cmsg_recv") Reported-by: Andrey Konovalov <andreyknvl@google.com> Signed-off-by: Paolo Abeni <pabeni@redhat.com> --- net/ipv4/ip_sockglue.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)