Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754568AbbHNALF (ORCPT ); Thu, 13 Aug 2015 20:11:05 -0400 Received: from shards.monkeyblade.net ([149.20.54.216]:40239 "EHLO shards.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752135AbbHNALD convert rfc822-to-8bit (ORCPT ); Thu, 13 Aug 2015 20:11:03 -0400 Date: Thu, 13 Aug 2015 17:11:01 -0700 (PDT) Message-Id: <20150813.171101.925018652514860039.davem@davemloft.net> To: linus.luessing@c0d3.blue Cc: netdev@vger.kernel.org, bridge@lists.linux-foundation.org, linux-kernel@vger.kernel.org, stephen@networkplumber.org, herbert@gondor.apana.org.au, bblanco@plumgrid.com, alexei.starovoitov@gmail.com Subject: Re: [PATCH] net: fix wrong skb_get() usage / crash in IGMP/MLD parsing code From: David Miller In-Reply-To: <1439438047-19441-1-git-send-email-linus.luessing@c0d3.blue> References: <1439438047-19441-1-git-send-email-linus.luessing@c0d3.blue> X-Mailer: Mew version 6.6 on Emacs 24.5 / Mule 6.0 (HANACHIRUSATO) Mime-Version: 1.0 Content-Type: Text/Plain; charset=iso-8859-1 Content-Transfer-Encoding: 8BIT X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.5.12 (shards.monkeyblade.net [149.20.54.216]); Thu, 13 Aug 2015 17:11:02 -0700 (PDT) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1278 Lines: 28 From: Linus L?ssing Date: Thu, 13 Aug 2015 05:54:07 +0200 > The recent refactoring of the IGMP and MLD parsing code into > ipv6_mc_check_mld() / ip_mc_check_igmp() introduced a potential crash / > BUG() invocation for bridges: > > I wrongly assumed that skb_get() could be used as a simple reference > counter for an skb which is not the case. skb_get() bears additional > semantics, a user count. This leads to a BUG() invocation in > pskb_expand_head() / kernel panic if pskb_may_pull() is called on an skb > with a user count greater than one - unfortunately the refactoring did > just that. > > Fixing this by removing the skb_get() call and changing the API: The > caller of ipv6_mc_check_mld() / ip_mc_check_igmp() now needs to > additionally check whether the returned skb_trimmed is a clone. > > Fixes: 9afd85c9e455 ("net: Export IGMP/MLD message validation code") > Reported-by: Brenden Blanco > Signed-off-by: Linus L?ssing Applied, thanks. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/