All of lore.kernel.org
 help / color / mirror / Atom feed
From: patchwork-bot+netdevbpf@kernel.org
To: Paolo Abeni <pabeni@redhat.com>
Cc: netdev@vger.kernel.org, linyunsheng@huawei.com,
	dseok.yi@samsung.com, willemb@google.com
Subject: Re: [PATCH net-next] skbuff: revert "skbuff: remove some unnecessary operation in skb_segment_list()"
Date: Wed, 14 Apr 2021 21:10:10 +0000	[thread overview]
Message-ID: <161843461063.4219.11828406452249254320.git-patchwork-notify@kernel.org> (raw)
In-Reply-To: <f092ecf89336221af04310c9feac800e49d4647f.1618397249.git.pabeni@redhat.com>

Hello:

This patch was applied to netdev/net-next.git (refs/heads/master):

On Wed, 14 Apr 2021 12:48:48 +0200 you wrote:
> the commit 1ddc3229ad3c ("skbuff: remove some unnecessary operation
> in skb_segment_list()") introduces an issue very similar to the
> one already fixed by commit 53475c5dd856 ("net: fix use-after-free when
> UDP GRO with shared fraglist").
> 
> If the GSO skb goes though skb_clone() and pskb_expand_head() before
> entering skb_segment_list(), the latter  will unshare the frag_list
> skbs and will release the old list. With the reverted commit in place,
> when skb_segment_list() completes, skb->next points to the just
> released list, and later on the kernel will hit UaF.
> 
> [...]

Here is the summary with links:
  - [net-next] skbuff: revert "skbuff: remove some unnecessary operation in skb_segment_list()"
    https://git.kernel.org/netdev/net-next/c/17c3df7078e3

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html



  reply	other threads:[~2021-04-14 21:10 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-04-14 10:48 [PATCH net-next] skbuff: revert "skbuff: remove some unnecessary operation in skb_segment_list()" Paolo Abeni
2021-04-14 21:10 ` patchwork-bot+netdevbpf [this message]
2021-04-15  2:23 ` Yunsheng Lin
2021-04-15  4:10   ` Dongseok Yi

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=161843461063.4219.11828406452249254320.git-patchwork-notify@kernel.org \
    --to=patchwork-bot+netdevbpf@kernel.org \
    --cc=dseok.yi@samsung.com \
    --cc=linyunsheng@huawei.com \
    --cc=netdev@vger.kernel.org \
    --cc=pabeni@redhat.com \
    --cc=willemb@google.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.