Re: [3/3] gso: Handle malicious GRO packets without crashing

Herbert Xu
2013-11-11T18:55:09Z

On Thu, Nov 07, 2013 at 10:13:29PM +0300, Sergei Shtylyov wrote:
> Hello.
>
> On 11/07/2013 10:08 AM, Herbert Xu wrote:
>
> >As virtio_net can now generate GRO frag_list packets without
> >sufficient verification, we need to handle malicious GRO packets
> >thrown at us.
>
> >This patch converts to affected BUG_ONs in skb_segment to rate-
> >limited warnings.
>
> >Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
>
> >diff --git a/net/core/skbuff.c b/net/core/skbuff.c
> >index bcc3f1c..fb1106d 100644
> >--- a/net/core/skbuff.c
> >+++ b/net/core/skbuff.c
> >@@ -2881,7 +2881,15 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
> > while (tail->next)
> > tail = tail->next;
> >
> >- BUG_ON(fskb && tail->len != len + doffset);
> >+ if (fskb && tail->len != len + doffset) {
> >+ net_warn_ratelimited(
> >+ "skb_segment: "
> >+ "illegal GSO fragment: %u %u\n",
>
> Don't break up the message -- chekpatch.pl should allow that...

Thanks for the comment. In the latest version of this patch
this should no longer be an issue.
--
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt