From: Florian Westphal <fw@strlen.de>
To: Konstantin Khlebnikov <koct9i@gmail.com>
Cc: Florian Westphal <fw@strlen.de>,
Thadeu Lima de Souza Cascardo <cascardo@redhat.com>,
Cong Wang <xiyou.wangcong@gmail.com>,
Linux Kernel Network Developers <netdev@vger.kernel.org>,
David Miller <davem@davemloft.net>,
Eric Dumazet <edumazet@google.com>,
Linux Kernel Mailing List <linux-kernel@vger.kernel.org>
Subject: Re: [BUG] skb corruption and kernel panic at forwarding with fragmentation
Date: Thu, 7 Jan 2016 13:03:39 +0100 [thread overview]
Message-ID: <20160107120339.GC23789@breakpoint.cc> (raw)
In-Reply-To: <CALYGNiObS1fuDNi7Q69BwoWmU8xOnndzy7Z-m35aphjQWUuEnQ@mail.gmail.com>
Konstantin Khlebnikov <koct9i@gmail.com> wrote:
> On Thu, Jan 7, 2016 at 2:49 AM, Florian Westphal <fw@strlen.de> wrote:
> > ... but it seems that those three are the only affected callers
> > of skb_gso_segment (tbf is ok since skb isn't owned by anyone,
> > ovs does save/restore already).
> >
> > I think this patch is the right way, we just need similar
> > save/restore in nfqnl_enqueue_packet and xfrm_output_gso().
>
> Which CB could be here? at this point skb isn't owned by netlink yet.
inet(6)_skb_parm, nfqnl_enqueue_packet is called via netfilter hooks, skb
is owned by ipv4 or ipv6 stack.
> > The latter two can be used by either ipv4 or ipv6 so it might
> > be preferable to just save/restore sizeof(struct skb_gso_cb);
> > or a union of inet_skb_parm+inet6_skb_parm.
>
> Or just shift GSO CB and add couple checks like
> BUILD_BUG_ON(sizeof(SKB_GSO_CB(skb)->room) < sizeof(*IPCB(skb)));
Right, that works too.
next prev parent reply other threads:[~2016-01-07 12:03 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-01-06 19:15 [BUG] skb corruption and kernel panic at forwarding with fragmentation Konstantin Khlebnikov
2016-01-06 19:59 ` Cong Wang
2016-01-06 20:11 ` Konstantin Khlebnikov
2016-01-06 21:05 ` Thadeu Lima de Souza Cascardo
2016-01-06 22:03 ` Florian Westphal
2016-01-06 23:49 ` Florian Westphal
2016-01-07 11:00 ` Konstantin Khlebnikov
2016-01-07 11:38 ` Konstantin Khlebnikov
2016-01-07 11:59 ` Eric Dumazet
2016-01-07 12:04 ` Konstantin Khlebnikov
2016-01-07 12:54 ` Eric Dumazet
2016-01-07 19:35 ` Konstantin Khlebnikov
2016-01-07 19:47 ` Eric Dumazet
2016-01-07 12:03 ` Florian Westphal [this message]
2016-01-07 18:43 ` [PATCH] net: prevent corruption of skb when using skb_gso_segment Thadeu Lima de Souza Cascardo
2016-01-07 19:31 ` Florian Westphal
2016-01-07 21:16 ` [PATCH v2] " Thadeu Lima de Souza Cascardo
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160107120339.GC23789@breakpoint.cc \
--to=fw@strlen.de \
--cc=cascardo@redhat.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=koct9i@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=xiyou.wangcong@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).