From patchwork Mon Jul 2 20:43:46 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alexander Aring X-Patchwork-Id: 10502371 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id E021760362 for ; Mon, 2 Jul 2018 20:44:32 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id CE17F28CC3 for ; Mon, 2 Jul 2018 20:44:32 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id C22A228CF8; Mon, 2 Jul 2018 20:44:32 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.8 required=2.0 tests=BAYES_00,DKIM_SIGNED, MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI, T_DKIM_INVALID autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 6882928CC3 for ; Mon, 2 Jul 2018 20:44:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752833AbeGBUny (ORCPT ); Mon, 2 Jul 2018 16:43:54 -0400 Received: from mail-it0-f65.google.com ([209.85.214.65]:50388 "EHLO mail-it0-f65.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752728AbeGBUnx (ORCPT ); Mon, 2 Jul 2018 16:43:53 -0400 Received: by mail-it0-f65.google.com with SMTP id u4-v6so172411itg.0 for ; Mon, 02 Jul 2018 13:43:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mojatatu-com.20150623.gappssmtp.com; s=20150623; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to:user-agent; bh=e6Q6Pz62yXotXW3zyTdsIVn8Lr+MQtonEfNPYK8QiKM=; b=Upb2qtQ5S8xZoej9E99PhzyPoNjTASKRcgPbQhNKiRDFwj+OXpMIZfXQGBL6DHxZPw GMIVmL6EJEvliXo0ePSdm6JnpV8XSBDEZl8axyX/Jpujev3KqoTkpYUY2NOsEIyir1Ch /O41hMXvgG7Rlex443ZBPi//7tEsiCnp4ElitenpgMHzvYPbT0HiHux+f7Rva3sMFknr bFEbGH3LPZ1QyUY14Oc4mcGCBNo1f2QXD/A3iqE4qI30WUMLH9xi+bMdQK7q9xhUbkh5 U046ZqgIIcyKYs5nOa3F48xEBsFAjlrsyUFZyR6Fg7wdgjjRJFJAN7eeCo15zk9Np2E8 jaTQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to:user-agent; bh=e6Q6Pz62yXotXW3zyTdsIVn8Lr+MQtonEfNPYK8QiKM=; b=isSphm/Q1JsN4hv+IfAAcx1yMUApsc9CdMY3MBeN58lPIlJ1Yqr49JhSlZVOkX1iPy MJ/FTtfgCBeuzmro5rUusCKKIdAfaPasGrL9EIFdlnbIPas3l+kKyx3rTaIZJ/g0voIg vmDuzhK4TY67TNyrCa2J86Pa2B4KL4xWMVJoBgnDW2pKCyrhpkfhMJCSeKJU5kw1cwxU pdBdeLuuotdjCQfHv8sChyP0OrYLukFQugraOCJtCNyr5eVKfGuOcMmNeDumJ1nV71Kl G7G7ZAx6UKCRMnpKLPx7j8KZllrozvnINdQZb1jrp9yxa/2d8fqArHIkAtbgzidls1Pp dXxA== X-Gm-Message-State: APt69E2jdzWeZf9dbAFDCX1u006pTYc9gf4wmpDrSDH6MUfUlhIWUDE6 psxXKqCqZc9GN//cOaJaCKePZA== X-Google-Smtp-Source: AAOMgpc15KQyEpQDgWjQO9goEcRgI0LQYAG+Xhua9VcTr5kKJhF1gD0khEy4nH70hBoxQqqvqe6P5A== X-Received: by 2002:a02:62ce:: with SMTP id d197-v6mr21975269jac.36.1530564232314; Mon, 02 Jul 2018 13:43:52 -0700 (PDT) Received: from x220t ([64.26.149.125]) by smtp.gmail.com with ESMTPSA id x7-v6sm6907612iob.49.2018.07.02.13.43.51 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Mon, 02 Jul 2018 13:43:51 -0700 (PDT) Date: Mon, 2 Jul 2018 16:43:46 -0400 From: Alexander Aring To: Michael Scott Cc: Jukka Rissanen , "David S. Miller" , linux-bluetooth@vger.kernel.org, linux-wpan@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] 6lowpan: iphc: reset mac_header after decompress to fix panic Message-ID: <20180702204346.d7bynetvzw3ayn5m@x220t> References: <20180619234406.8217-1-michael@opensourcefoundries.com> <20180702185438.dqqjg6k45iefj5is@x220t> <516fbc65-cc4b-8016-de5a-e2240b779d15@opensourcefoundries.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <516fbc65-cc4b-8016-de5a-e2240b779d15@opensourcefoundries.com> User-Agent: NeoMutt/20170113 (1.7.2) Sender: linux-wpan-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wpan@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Hi, On Mon, Jul 02, 2018 at 12:45:41PM -0700, Michael Scott wrote: > Hello Alexander, > ... > > Question is for me: which upper layer wants access MAC header here on > > receive path? > > It cannot parsed anyhow because so far I know no upper layer can parse > > at the moment 802.15.4 frames (which is a complex format). Maybe over > > some header_ops callback? > > I was testing a C program which performs NAT64 handling on packets > destined to a certain IPv6 subnet (64:ff9b::). To do this, the application > opens a RAW socket like this: sniff_sock = socket(PF_PACKET, SOCK_RAW, > htons(ETH_P_ALL)); It then sets promiscuous mode and enters a looping call > of: > length = recv(sniff_sock, buffer, PACKET_BUFFER, MSG_TRUNC); My host PC > kernel would then promptly crash on me. (I'm going to purposely avoid the > obvious point of: this probably isn't the best way to parse packets for > NAT64 translation as you will get every single packet incoming or outgoing > on the host.) Turns out, testing the program on an 802.15.4 6lowpan > interface exposed some of the issues which this mailing list (but not > myself) is well aware of (no L2 data in the RAW packets) and also led me to > debugging this patch to stop the kernel crash. TL;DR: To summarize, any > PF_PACKET SOCK_RAW socket which recv()'s IPv6 data from a 6lowpan node will > cause this kernel crash eventually (checked on kernel 4.15, 4.16, 4.17 and > 4.18-rc1). - Mike > > "any PF_PACKET SOCK_RAW" can't be otherwise I would also see it with my sniffer programs e.g. wireshark or tcpdump which use libpcap. There need to be some different in the handling. This is what I have currently in my mind. I currently not sure how to set skb->mac_header if interface is RAW_IP. It seems there is an indicator that mac header is not set. Example: Maybe we should lookup what skb->mac_header points to on tun interfaces then do the same. - Alex --- To unsubscribe from this list: send the line "unsubscribe linux-wpan" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/net/6lowpan/iphc.c b/net/6lowpan/iphc.c index 6b1042e21656..e6ec2df3afe0 100644 --- a/net/6lowpan/iphc.c +++ b/net/6lowpan/iphc.c @@ -770,6 +770,7 @@ int lowpan_header_decompress(struct sk_buff *skb, const struct net_device *dev, hdr.hop_limit, &hdr.daddr); skb_push(skb, sizeof(hdr)); + skb->mac_header = (typeof(skb->mac_header))~0U; skb_reset_network_header(skb); skb_copy_to_linear_data(skb, &hdr, sizeof(hdr));