From mboxrd@z Thu Jan  1 00:00:00 1970
From: James Morris <james.l.morris@oracle.com>
Subject: Re: [BUG] kernel stack corruption during/after Netlabel error
Date: Thu, 30 Nov 2017 10:41:29 +1100 (AEDT)
Message-ID: <alpine.LFD.2.20.1711301040400.16533@localhost>
References: <alpine.LFD.2.20.1711292113350.7808@localhost>  <1511976706.10464.19.camel@tycho.nsa.gov>  <CANn89iJc=tZkN41WoCm5Zy9nPfs1tfZf9nuSXYS9EB_aem+y4g@mail.gmail.com>  <1511985547.10464.22.camel@tycho.nsa.gov>  <CANn89iK23gDN_ma3MyybzgDkBr_A7R-MPfAG3dS_f7ehpiJtJQ@mail.gmail.com>
 <1511995754.16595.27.camel@gmail.com>
Mime-Version: 1.0
Content-Type: multipart/mixed; BOUNDARY="8323328-1073903225-1511998893=:16533"
Cc: Eric Dumazet <edumazet@google.com>,
        Stephen Smalley <sds@tycho.nsa.gov>,
        Paul Moore <paul@paul-moore.com>,
        netdev <netdev@vger.kernel.org>, selinux@tycho.nsa.gov
To: Eric Dumazet <eric.dumazet@gmail.com>
Return-path: <netdev-owner@vger.kernel.org>
Received: from userp1040.oracle.com ([156.151.31.81]:49858 "EHLO
        userp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1752368AbdK2XmL (ORCPT
        <rfc822;netdev@vger.kernel.org>); Wed, 29 Nov 2017 18:42:11 -0500
In-Reply-To: <1511995754.16595.27.camel@gmail.com>
Sender: netdev-owner@vger.kernel.org
List-ID: <netdev.vger.kernel.org>

--8323328-1073903225-1511998893=:16533
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: QUOTED-PRINTABLE

On Wed, 29 Nov 2017, Eric Dumazet wrote:

> On Wed, 2017-11-29 at 12:23 -0800, Eric Dumazet wrote:
> >=20
> > I suspect this exposes an ancient bug, caused by fact that TCP moves
> > IP[6]CB in skb->cb[]
> >=20
> > Basically the 2nd tcp_filter() added in commit
> > 8fac365f63c866a00015fa13932d8ffc584518b8
> > ("tcp: Add a tcp_filter hook before handle ack packet") was not
> > expecting selinux code being called a 2nd time,
> > while skb->cb[] has been mangled [1]
> >=20
> > [1]
> > memmove(&TCP_SKB_CB(skb)->header.h4, IPCB(skb),
> > =C2=A0=C2=A0=C2=A0=C2=A0sizeof(struct inet_skb_parm));
>=20
> Please try this fix for IPv4 (a similar patch will be needed for IPv6)
>=20
>  net/ipv4/tcp_ipv4.c |   51 ++++++++++++++++++++++++++----------------
>  1 file changed, 32 insertions(+), 19 deletions(-)

Works for me, no crashes with the testsuite running in a loop.


Tested-by: James Morris <james.l.morris@oracle.com>


--=20
James Morris
<james.l.morris@oracle.com>

--8323328-1073903225-1511998893=:16533--