Home » Mailing list archives » linux-netdev » 2010 » June » 30

Re: static inline int xfrm_mark_get() broken

Previous thread: [PATCH net-2.6 1/2] ethtool: Fix potential kernel buffer overflow in ETHTOOL_GRXCLSRLALL by Ben Hutchings on Monday, June 28, 2010 - 11:44 am. (2 messages)

Next thread: [patch] isdn/gigaset: add a kfree() to error path by Dan Carpenter on Monday, June 28, 2010 - 2:20 pm. (3 messages)
[view original message]
From: Andreas Steffen
Subject: static inline int xfrm_mark_get() broken
Date: Monday, June 28, 2010 - 11:46 am

Hi,

experimenting with the new XFRM_MARK feature of the 2.6.34 kernel
I found out that the extraction of the mark mask might accidentally
work on 64 bit platforms but on 32 bit platforms the function is
awfully broken. The rather trivial patch attached to this mail fixes
the problem. Otherwise the XFRM_MARK feature seems quite promising!

Best regards

Andreas

======================================================================
Andreas Steffen                         e-mail: andreas.steffen@hsr.ch
Institute for Internet Technologies and Applications
Hochschule fuer Technik Rapperswil      phone:  +41 55 222 42 68
CH-8640 Rapperswil (Switzerland)        mobile: +41 76 340 25 56
===========================================================[ITA-HSR]==

[ message continues ]
[view original message]
From: Simon Horman
Subject: Re: static inline int xfrm_mark_get() broken
Date: Tuesday, June 29, 2010 - 9:46 pm

This fix looks correct to me, but

--


[ message continues ]
[view original message]
From: Andreas Steffen
Subject: Re: static inline int xfrm_mark_get() broken
Date: Tuesday, June 29, 2010 - 10:03 pm

Hello Simon,

actually I don't care how this bug is going to be fixed, but with
sizeof(struct xfrm_mark) I'm dead certain that both the mark
value and mask are being copied. Actually in the next inline
function right below sizeof(struct xfrm_mark) is used, too:

static inline int xfrm_mark_put(struct sk_buff *skb, struct xfrm_mark *m)
{
    if (m->m | m->v)
       NLA_PUT(skb, XFRMA_MARK, sizeof(struct xfrm_mark), m);
    return 0;

Regards

Andreas


======================================================================
Andreas Steffen                         e-mail: andreas.steffen@hsr.ch
Institute for Internet Technologies and Applications
Hochschule fuer Technik Rapperswil      phone:  +41 55 222 42 68
CH-8640 Rapperswil (Switzerland)        mobile: +41 76 340 25 56
===========================================================[ITA-HSR]==
--


[ message continues ]
[view original message]
From: Simon Horman
Subject: Re: static inline int xfrm_mark_get() broken
Date: Wednesday, June 30, 2010 - 12:01 am

In that case I withdraw my suggestion.
--


[ message continues ]
Previous thread: [PATCH net-2.6 1/2] ethtool: Fix potential kernel buffer overflow in ETHTOOL_GRXCLSRLALL by Ben Hutchings on Monday, June 28, 2010 - 11:44 am. (2 messages)

Next thread: [patch] isdn/gigaset: add a kfree() to error path by Dan Carpenter on Monday, June 28, 2010 - 2:20 pm. (3 messages)