Fengtao (fengtao, Euler) <[email protected]> wrote:
> Hi
>
> I have tested the patch, the panic not happend.
> And I search the similar issue in kernel, and found commit:
> [1]https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ed0de45a1008
> [2]https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3da1ed7ac398
>
> So I tested another patch like this:
> ------------[ cut here ]------------
> --- .//net/ipv4/netfilter/nf_reject_ipv4.c 2023-05-02 13:03:35.427896081 +0000
> +++ .//net/ipv4/netfilter/nf_reject_ipv4.c.new 2023-05-02 13:03:00.433897970 +0000
> @@ -187,6 +187,7 @@ >
> void nf_send_unreach(struct sk_buff *skb_in, int code, int hook)
> {
> + struct ip_options opt;
> struct iphdr *iph = ip_hdr(skb_in);
> u8 proto = iph->protocol;
>
> @@ -196,13 +197,18 @@
> if (hook == NF_INET_PRE_ROUTING && nf_reject_fill_skb_dst(skb_in))
> return;
>
> + memset(&opt, 0, sizeof(opt));
> + opt.optlen = iph->ihl*4 - sizeof(struct iphdr);
> + if (__ip_options_compile(dev_net(skb_in->dev), &opt, skb_in, NULL))
> + return;
> +
> if (skb_csum_unnecessary(skb_in) || !nf_reject_verify_csum(proto)) {
> - icmp_send(skb_in, ICMP_DEST_UNREACH, code, 0);
> + __icmp_send(skb_in, ICMP_DEST_UNREACH, code, 0, &opt);
> return;
> }
>
> if (nf_ip_checksum(skb_in, hook, ip_hdrlen(skb_in), proto) == 0)
> - icmp_send(skb_in, ICMP_DEST_UNREACH, code, 0);
> + __icmp_send(skb_in, ICMP_DEST_UNREACH, code, 0, &opt);
> }
> EXPORT_SYMBOL_GPL(nf_send_unreach);
> ------------[ cut here ]------------
>
> This can also fix the issue :)
No, it papers over the problem, by only fixing this specific instance
(icmpv4). What about ipv6? What about all other IPCB accesses?
> BTW, I think the problem is more then ipvlan? Maybe some other scenarios that can trigger such issue.
Such as?
I don't see how this is fixable, just have have a look at "git grep
IPCB", how do you envision stack to know how such access is valid or
not?