Re: [PATCH net-next] net: ip6_gre: get ipv6hdr after skb_cow_head()

2018-07-16 Thread David Miller
From: Prashant Bhole Date: Fri, 13 Jul 2018 14:40:50 +0900 > A KASAN:use-after-free bug was found related to ip6-erspan > while running selftests/net/ip6_gre_headroom.sh > > It happens because of following sequence: > - ipv6hdr pointer is obtained from skb > - skb_cow_head() is called, skb->head

Re: [PATCH net-next] net: ip6_gre: get ipv6hdr after skb_cow_head()

2018-07-13 Thread William Tu
On Thu, Jul 12, 2018 at 10:40 PM, Prashant Bhole wrote: > A KASAN:use-after-free bug was found related to ip6-erspan > while running selftests/net/ip6_gre_headroom.sh > > It happens because of following sequence: > - ipv6hdr pointer is obtained from skb > - skb_cow_head() is called, skb->head memo

Re: [PATCH net-next] net: ip6_gre: get ipv6hdr after skb_cow_head()

2018-07-13 Thread Gregory Rose
On 7/12/2018 10:40 PM, Prashant Bhole wrote: A KASAN:use-after-free bug was found related to ip6-erspan while running selftests/net/ip6_gre_headroom.sh It happens because of following sequence: - ipv6hdr pointer is obtained from skb - skb_cow_head() is called, skb->head memory is reallocated - o

[PATCH net-next] net: ip6_gre: get ipv6hdr after skb_cow_head()

2018-07-12 Thread Prashant Bhole
A KASAN:use-after-free bug was found related to ip6-erspan while running selftests/net/ip6_gre_headroom.sh It happens because of following sequence: - ipv6hdr pointer is obtained from skb - skb_cow_head() is called, skb->head memory is reallocated - old data is accessed using ipv6hdr pointer skb_