Re: [PATCH net v3 1/2] packet: use consistent hard_header_len in non-ring send paths

[Willem de Bruijn <willemdebruijn.kernel@gmail.com>]

Qihang wrote:
> packet_snd() reads dev->hard_header_len multiple times while allocating
> and constructing an skb. Device reconfiguration can change this value
> concurrently, for example through bonding device type changes.
> 
> For SOCK_RAW, packet_snd() can save a larger value in reserve and later
> allocate headroom using a smaller value. Moving skb->data back by reserve
> then places it before skb->head, and the following copy from userspace can
> attempt an out-of-bounds write.
> 
> packet_sendmsg_spkt() has the same issue because it calculates its
> reservation and header offset from separate reads before dropping the RCU
> read lock to allocate the skb.
> 
> Add LL_RESERVED_SPACE_EX() for callers that already saved a header length.
> Read hard_header_len once in packet_snd() and use it for allocation and
> construction. In packet_sendmsg_spkt(), preserve the allocation-time value
> through the device lookup retry.
> 
> The separate SOCK_DGRAM consistency problem between hard_header_len and
> header_ops->create is not addressed here.
> 
> Fixes: b84bbaf7a6c8 ("packet: in packet_snd start writing at link layer allocation")
> Cc: stable@vger.kernel.org
> Signed-off-by: Qihang <q.h.hack.winter@gmail.com>

Reviewed-by: Willem de Bruijn <willemb@google.com>

New revisions should not be sent as a reply to an existing thread.