From: "Ewan D. Milne" <emilne@redhat.com>
To: "Martin K. Petersen" <martin.petersen@oracle.com>
Cc: Xin Long <lucien.xin@gmail.com>,
linux-scsi@vger.kernel.org,
"James E.J. Bottomley" <JBottomley@odin.com>,
syzkaller@googlegroups.com, chunwang@redhat.com
Subject: Re: [PATCH] scsi: fix the issue that iscsi_if_rx doesn't parse nlmsg properly
Date: Fri, 29 Sep 2017 09:33:34 -0400 [thread overview]
Message-ID: <1506692014.4100.543.camel@localhost.localdomain> (raw)
In-Reply-To: <yq1a81ih92k.fsf@oracle.com>
On Mon, 2017-09-25 at 15:28 -0400, Martin K. Petersen wrote:
> Xin,
>
> > ChunYu found a kernel crash by syzkaller:
>
> [...]
>
> > It's caused by skb_shared_info at the end of sk_buff was overwritten by
> > ISCSI_KEVENT_IF_ERROR when parsing nlmsg info from skb in iscsi_if_rx.
> >
> > During the loop if skb->len == nlh->nlmsg_len and both are sizeof(*nlh),
> > ev = nlmsg_data(nlh) will acutally get skb_shinfo(SKB) instead and set a
> > new value to skb_shinfo(SKB)->nr_frags by ev->type.
> >
> > This patch is to fix it by checking nlh->nlmsg_len properly there to
> > avoid over accessing sk_buff.
>
> Applied to 4.14/scsi-fixes. Thank you!
>
Should this be considered for -stable? (Despite not being reproduced
after 7f564528a4).
prev parent reply other threads:[~2017-09-29 13:33 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-08-27 12:25 [PATCH] scsi: fix the issue that iscsi_if_rx doesn't parse nlmsg properly Xin Long
2017-08-27 12:37 ` Xin Long
2017-09-13 15:51 ` Chris Leech
2017-09-25 10:56 ` Vladis Dronov
2017-09-25 19:28 ` [PATCH] " Martin K. Petersen
2017-09-29 13:33 ` Ewan D. Milne [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1506692014.4100.543.camel@localhost.localdomain \
--to=emilne@redhat.com \
--cc=JBottomley@odin.com \
--cc=chunwang@redhat.com \
--cc=linux-scsi@vger.kernel.org \
--cc=lucien.xin@gmail.com \
--cc=martin.petersen@oracle.com \
--cc=syzkaller@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.