Re: [net-next PATCH 1/3] Revert "icmp: avoid allocating large struct on stack"
From: Jesper Dangaard Brouer <hidden>
Date: 2017-01-10 20:08:27
On Tue, 10 Jan 2017 10:44:59 -0800 Cong Wang [off-list ref] wrote:
On Tue, Jan 10, 2017 at 10:12 AM, David Miller [off-list ref] wrote:
[...]
quoted
You can keep showing us how expertly you can deflect the real issue we are discussion here, but that won't improve the situation at all I am afraid.Of course, there are just too many people too lazy to do a google search: https://lists.debian.org/debian-kernel/2013/05/msg00500.html
My analysis of the problem shown in above link is not related to using
all the stack space, but instead that skb->cb was not cleared. This
can cause the ip_options_echo() call in icmp_send() to access garbage
as this is: __ip_options_echo(dopt, skb, &IPCB(skb)->opt).
Fixed by commit a622260254ee ("ip_tunnel: fix kernel panic with icmp_dest_unreach")
https://git.kernel.org/torvalds/c/a622260254ee
Thus, it is (likely) the __ip_options_echo() call that violates stack
access, as it is passed in a pointer to the stack, and advance this
based on garbage "optlen".
--
Best regards,
Jesper Dangaard Brouer
MSc.CS, Principal Kernel Engineer at Red Hat
LinkedIn: http://www.linkedin.com/in/brouer