Re: v4.16-rc1 misaligned atomics in skb__clone / __napi_alloc_skb
From: Eric Dumazet <edumazet@google.com>
Date: 2018-02-15 17:24:42
Also in:
lkml
On Thu, Feb 15, 2018 at 9:20 AM, Eric Dumazet [off-list ref] wrote:
Yes, it seems tun.c breaks the assumptions. If it really wants to provide arbitrary fragments and alignments, it should use a separate
Sorry, I have sent the message to soon. tun.c should use a private 'struct page_frag_cache' to deliver arbitrary frags/alignments, so that syzkaller might catch interesting bugs in the stack.
quoted hunk ↗ jump to hunk
Please try :diff --git a/drivers/net/tun.c b/drivers/net/tun.c index 81e6cc951e7fc7c983919365c34842c34bcaedcf..92c6b6d02f7c18b63c42ffe1d9cb7286975e1263100644--- a/drivers/net/tun.c +++ b/drivers/net/tun.c@@ -1500,7 +1500,7 @@ static struct sk_buff*tun_napi_alloc_frags(struct tun_file *tfile, } local_bh_disable(); - data = napi_alloc_frag(fragsz); + data = napi_alloc_frag(SKB_DATA_ALIGN(fragsz)); local_bh_enable(); if (!data) { err = -ENOMEM;
This patch should solve your immediate problem, but would lower fuzzer abilities to find bugs. I will send something more suited to original intent of these commits : 90e33d45940793def6f773b2d528e9f3c84ffdc7 tun: enable napi_gro_frags() for TUN/TAP driver 943170998b200190f99d3fe7e771437e2c51f319 tun: enable NAPI for TUN/TAP driver