| Message ID | 20220512062629.10286-1-imagedong@tencent.com (mailing list archive) |
|---|---|
| Headers | show |
| Series | net: skb: check the boundrary of skb drop reason | expand |
On Thu, May 12, 2022 at 2:26 PM <menglong8.dong@gmail.com> wrote: > > From: Menglong Dong <imagedong@tencent.com> > > In the commit 1330b6ef3313 ("skb: make drop reason booleanable"), > SKB_NOT_DROPPED_YET is added to the enum skb_drop_reason, which makes > the invalid drop reason SKB_NOT_DROPPED_YET can leak to the kfree_skb > tracepoint. Once this happen (it happened, as 4th patch says), it can > cause NULL pointer in drop monitor and result in kernel panic. > > Therefore, check the boundrary of drop reason in both kfree_skb_reason > (2th patch) and drop monitor (1th patch). > > Meanwhile, fix the invalid drop reason passed to kfree_skb_reason() in > tcp_v4_rcv(). > tcp_v6_rcv() is forgeted, I'll send a V2 :/ > Menglong Dong (4): > net: dm: check the boundary of skb drop reasons > net: skb: check the boundrary of drop reason in kfree_skb_reason() > net: skb: change the definition SKB_DR_SET() > net: tcp: reset skb drop reason to NOT_SPCIFIED in tcp_v4_rcv() > > include/linux/skbuff.h | 3 ++- > net/core/drop_monitor.c | 2 +- > net/core/skbuff.c | 5 +++++ > net/ipv4/tcp_ipv4.c | 1 + > 4 files changed, 9 insertions(+), 2 deletions(-) > > -- > 2.36.1 >
On Thu, 12 May 2022 20:31:14 +0800 Menglong Dong wrote: > On Thu, May 12, 2022 at 2:26 PM <menglong8.dong@gmail.com> wrote: > > > > From: Menglong Dong <imagedong@tencent.com> > > > > In the commit 1330b6ef3313 ("skb: make drop reason booleanable"), > > SKB_NOT_DROPPED_YET is added to the enum skb_drop_reason, which makes > > the invalid drop reason SKB_NOT_DROPPED_YET can leak to the kfree_skb > > tracepoint. Once this happen (it happened, as 4th patch says), it can > > cause NULL pointer in drop monitor and result in kernel panic. > > > > Therefore, check the boundrary of drop reason in both kfree_skb_reason > > (2th patch) and drop monitor (1th patch). > > > > Meanwhile, fix the invalid drop reason passed to kfree_skb_reason() in > > tcp_v4_rcv(). > > > > tcp_v6_rcv() is forgeted, I'll send a V2 :/ Please don't repost stuff within 24h: https://www.kernel.org/doc/html/latest/process/maintainer-netdev.html#i-have-received-review-feedback-when-should-i-post-a-revised-version-of-the-patches I could have given you the same exact feedback on v1 as v2...
From: Menglong Dong <imagedong@tencent.com> In the commit 1330b6ef3313 ("skb: make drop reason booleanable"), SKB_NOT_DROPPED_YET is added to the enum skb_drop_reason, which makes the invalid drop reason SKB_NOT_DROPPED_YET can leak to the kfree_skb tracepoint. Once this happen (it happened, as 4th patch says), it can cause NULL pointer in drop monitor and result in kernel panic. Therefore, check the boundrary of drop reason in both kfree_skb_reason (2th patch) and drop monitor (1th patch). Meanwhile, fix the invalid drop reason passed to kfree_skb_reason() in tcp_v4_rcv(). Menglong Dong (4): net: dm: check the boundary of skb drop reasons net: skb: check the boundrary of drop reason in kfree_skb_reason() net: skb: change the definition SKB_DR_SET() net: tcp: reset skb drop reason to NOT_SPCIFIED in tcp_v4_rcv() include/linux/skbuff.h | 3 ++- net/core/drop_monitor.c | 2 +- net/core/skbuff.c | 5 +++++ net/ipv4/tcp_ipv4.c | 1 + 4 files changed, 9 insertions(+), 2 deletions(-)