Re: [BUG] kernel stack corruption during/after Netlabel error
From: Casey Schaufler <casey@schaufler-ca.com>
Date: 2017-11-30 18:16:34
Also in:
linux-security-module, selinux
On 11/30/2017 9:57 AM, Eric Dumazet wrote:
On Thu, 2017-11-30 at 10:30 -0700, David Ahern wrote:quoted
On 11/30/17 8:44 AM, David Ahern wrote:quoted
On 11/30/17 3:50 AM, Eric Dumazet wrote:quoted
@@ -1631,24 +1659,6 @@ int tcp_v4_rcv(struct sk_buff *skb)th = (const struct tcphdr *)skb->data; iph = ip_hdr(skb); - /* This is tricky : We move IPCB at its correct location into TCP_SKB_CB() - * barrier() makes sure compiler wont play fool^Waliasing games. - */ - memmove(&TCP_SKB_CB(skb)->header.h4, IPCB(skb), - sizeof(struct inet_skb_parm)); - barrier(); - - TCP_SKB_CB(skb)->seq = ntohl(th->seq); - TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th-quoted
syn + th->fin +- skb->len - th->doff * 4); - TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq); - TCP_SKB_CB(skb)->tcp_flags = tcp_flag_byte(th); - TCP_SKB_CB(skb)->tcp_tw_isn = 0; - TCP_SKB_CB(skb)->ip_dsfield = ipv4_get_dsfield(iph); - TCP_SKB_CB(skb)->sacked = 0; - TCP_SKB_CB(skb)->has_rxtstamp = - skb->tstamp || skb_hwtstamps(skb)-quoted
hwtstamp;- lookup: sk = __inet_lookup_skb(&tcp_hashinfo, skb, __tcp_hdrlen(th), th->source, th->dest, sdif, &refcounted);I believe moving the above is going to affect lookups with VRF. Let me take a look before this gets committed.Eric: Can you add this to the patch? Fixes socket lookups with VRF which stashes a flag in the cb.
I've done my testing and it works both ways for Smack.
quoted
Thanks,diff --git a/include/net/tcp.h b/include/net/tcp.h index 4e09398009c1..6c020015d556 100644 --- a/include/net/tcp.h +++ b/include/net/tcp.h@@ -849,7 +849,7 @@ static inline bool inet_exact_dif_match(structnet *net, struct sk_buff *skb) { #if IS_ENABLED(CONFIG_NET_L3_MASTER_DEV) if (!net->ipv4.sysctl_tcp_l3mdev_accept && - skb && ipv4_l3mdev_skb(TCP_SKB_CB(skb)->header.h4.flags)) + skb && ipv4_l3mdev_skb(IPCB(skb)->flags)) return true; #endif return false;I wonder if this should not be in a separate patch ? Bug was added in 971f10eca186cab238c49daa91f703c5a001b0b1 ("tcp: better TCP_SKB_CB layout to reduce cache line misses") in linux 3.18 While VRF was added later. If you agree, I will prepare a patch series, with different Fixes tag so that David can decide which path needs to be backported into each stable version. Thanks.