From: David Miller <davem@davemloft.net>
To: hadi@cyberus.ca
Cc: xiaosuo@gmail.com, netdev@vger.kernel.org
Subject: Re: [PATCH] cls_u32: use skb_copy_bits() to dereference data safely
Date: Wed, 02 Jun 2010 05:47:36 -0700 (PDT) [thread overview]
Message-ID: <20100602.054736.215546689.davem@davemloft.net> (raw)
In-Reply-To: <1275481219.14363.6.camel@bigi>
From: jamal <hadi@cyberus.ca>
Date: Wed, 02 Jun 2010 08:20:19 -0400
> I am suprised we never caught this all this years and wondering why
> this never crashed in your example?
Well for one thing there is all sorts of "stuff" past the end of the
valid skb->data area. For example, there is some padding and then
there is skb_shared_info().
Furthermore, the kernel allocator can round up the size it uses for
SLAB objects which gives even more padding past the end of even
skb_shared_info().
Futrhermore, the chance of the page past the page skb->data is in
being invalid is very low. You'd have to have invalid memory in the
page after the skb->data.
All of this conspires to just letting blind reads work in a large
number of illegal cases.
next prev parent reply other threads:[~2010-06-02 12:47 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-05-31 2:24 [PATCH] cls_u32: use skb_copy_bits() to dereference data safely Changli Gao
2010-06-01 12:34 ` jamal
2010-06-01 17:47 ` Changli Gao
2010-06-02 12:20 ` jamal
2010-06-02 12:25 ` jamal
2010-06-02 12:45 ` David Miller
2010-06-02 13:14 ` Changli Gao
2010-06-02 13:27 ` David Miller
2010-06-02 13:36 ` jamal
2010-06-02 13:43 ` Changli Gao
2010-06-02 13:48 ` jamal
2010-06-02 13:43 ` David Miller
2010-06-02 13:47 ` jamal
2010-06-02 12:47 ` David Miller [this message]
2010-06-02 13:17 ` Changli Gao
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20100602.054736.215546689.davem@davemloft.net \
--to=davem@davemloft.net \
--cc=hadi@cyberus.ca \
--cc=netdev@vger.kernel.org \
--cc=xiaosuo@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).