From: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
To: David Miller <davem@davemloft.net>
Cc: adobriyan@sw.ru, netdev@vger.kernel.org, devel@openvz.org
Subject: Re: [PATCH] Copy mac_len in skb_clone() as well
Date: Thu, 15 Mar 2007 19:04:36 +0300 [thread overview]
Message-ID: <20070315160436.GA7482@ms2.inr.ac.ru> (raw)
In-Reply-To: <20070315.030235.79052031.davem@davemloft.net>
Hello!
> What bug triggered that helped you discover this? Or is it
> merely from a code audit?
I asked the same question. :-)
openvz added some another fields to skbuff and when it was found
that they are lost while clone, he tried to figure out how all this works
and looked for another examples of this kind.
As I understand, the problem can be seen only in xfrmX_tunnel_input.
If uninitialized mac_len obtained from slab is more than current head room
it could corrupt memory.
Also, it looks like the fix is incomplete. copy_skb_header() also does not
copy this field. But it will be initialized to 0 by alloc_skb in this case
and xfrmX_tunnel_input() just will not copy mac header.
Alexey
prev parent reply other threads:[~2007-03-15 16:14 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2007-03-14 13:07 [PATCH] Copy mac_len in skb_clone() as well Alexey Dobriyan
2007-03-15 10:02 ` David Miller
2007-03-15 10:33 ` [Devel] " Kirill Korotaev
2007-03-16 1:08 ` David Miller
2007-03-15 16:04 ` Alexey Kuznetsov [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20070315160436.GA7482@ms2.inr.ac.ru \
--to=kuznet@ms2.inr.ac.ru \
--cc=adobriyan@sw.ru \
--cc=davem@davemloft.net \
--cc=devel@openvz.org \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).