Re: [Security] [PATCH] infinite recursion in netlink

2007-04-26 Thread David Miller
From: Greg KH <[EMAIL PROTECTED]> Date: Wed, 25 Apr 2007 23:51:51 -0700 > Sorry for the false alarm, I have no idea what when wrong here. Glad > the bug is really fixed. Nothing to be sorry about, it's great that you double checked things even if it turned out to be a false alarm in the end. - T

Re: [Security] [PATCH] infinite recursion in netlink

2007-04-25 Thread Greg KH
On Wed, Apr 25, 2007 at 11:31:21PM -0700, David Miller wrote: > From: Chris Wright <[EMAIL PROTECTED]> > Date: Wed, 25 Apr 2007 23:26:01 -0700 > > > Working fine here. Any chance you booted a stale kernel? > > If not, what's your nl_fib_input+0xe4. Any chance that's > > actually in nl_fib_lookup

Re: [Security] [PATCH] infinite recursion in netlink

2007-04-25 Thread David Miller
From: Chris Wright <[EMAIL PROTECTED]> Date: Wed, 25 Apr 2007 23:26:01 -0700 > Working fine here. Any chance you booted a stale kernel? > If not, what's your nl_fib_input+0xe4. Any chance that's > actually in nl_fib_lookup? I'm seriously hoping it's a stale kernel or similar, because I can't ac

Re: [Security] [PATCH] infinite recursion in netlink

2007-04-25 Thread Chris Wright
* Chris Wright ([EMAIL PROTECTED]) wrote: > * Greg KH ([EMAIL PROTECTED]) wrote: > > fyi, here's the patch that I applied, perhaps 2.6.20 needed something > > else too? > > > @@ -809,7 +815,7 @@ static void nl_fib_input(struct sock *sk > > > > nl_fib_lookup(frn, tb); > > > > - pid = n

Re: [Security] [PATCH] infinite recursion in netlink

2007-04-25 Thread Chris Wright
* Greg KH ([EMAIL PROTECTED]) wrote: > fyi, here's the patch that I applied, perhaps 2.6.20 needed something > else too? > @@ -809,7 +815,7 @@ static void nl_fib_input(struct sock *sk > > nl_fib_lookup(frn, tb); > > - pid = nlh->nlmsg_pid; /*pid of sending process */ >

Re: [Security] [PATCH] infinite recursion in netlink

2007-04-25 Thread Greg KH
On Wed, Apr 25, 2007 at 10:44:20PM -0700, Greg KH wrote: > On Wed, Apr 25, 2007 at 10:32:01PM -0700, David Miller wrote: > > From: Greg KH <[EMAIL PROTECTED]> > > Date: Wed, 25 Apr 2007 22:29:12 -0700 > > > > > On Wed, Apr 25, 2007 at 01:15:12PM -0700, Linus Torvalds wrote: > > > > > > > > > > >

Re: [Security] [PATCH] infinite recursion in netlink

2007-04-25 Thread Greg KH
On Wed, Apr 25, 2007 at 10:32:01PM -0700, David Miller wrote: > From: Greg KH <[EMAIL PROTECTED]> > Date: Wed, 25 Apr 2007 22:29:12 -0700 > > > On Wed, Apr 25, 2007 at 01:15:12PM -0700, Linus Torvalds wrote: > > > > > > > > > On Wed, 25 Apr 2007, Alexey Kuznetsov wrote: > > > > > > > > Reply to

Re: [Security] [PATCH] infinite recursion in netlink

2007-04-25 Thread Chris Wright
* Greg KH ([EMAIL PROTECTED]) wrote: > On Wed, Apr 25, 2007 at 01:15:12PM -0700, Linus Torvalds wrote: > > > > > > On Wed, 25 Apr 2007, Alexey Kuznetsov wrote: > > > > > > Reply to NETLINK_FIB_LOOKUP messages were misrouted back to kernel, > > > which resulted in infinite recursion and stack ove

Re: [Security] [PATCH] infinite recursion in netlink

2007-04-25 Thread David Miller
From: Greg KH <[EMAIL PROTECTED]> Date: Wed, 25 Apr 2007 22:29:12 -0700 > On Wed, Apr 25, 2007 at 01:15:12PM -0700, Linus Torvalds wrote: > > > > > > On Wed, 25 Apr 2007, Alexey Kuznetsov wrote: > > > > > > Reply to NETLINK_FIB_LOOKUP messages were misrouted back to kernel, > > > which resulted

Re: [Security] [PATCH] infinite recursion in netlink

2007-04-25 Thread Greg KH
On Wed, Apr 25, 2007 at 01:15:12PM -0700, Linus Torvalds wrote: > > > On Wed, 25 Apr 2007, Alexey Kuznetsov wrote: > > > > Reply to NETLINK_FIB_LOOKUP messages were misrouted back to kernel, > > which resulted in infinite recursion and stack overflow. Wait, I just had the bright idea of actuall

Re: [Security] [PATCH] infinite recursion in netlink

2007-04-25 Thread Linus Torvalds
On Wed, 25 Apr 2007, Alexey Kuznetsov wrote: > > Reply to NETLINK_FIB_LOOKUP messages were misrouted back to kernel, > which resulted in infinite recursion and stack overflow. So I assume it's this line that actually _fixes_ it: > - pid = nlh->nlmsg_pid; /*pid of sending process

Re: [Security] [PATCH] infinite recursion in netlink

2007-04-25 Thread David Miller
From: Linus Torvalds <[EMAIL PROTECTED]> Date: Wed, 25 Apr 2007 13:15:12 -0700 (PDT) > If so, shouldn't we also have some safety-net to make sure it doesn't > still get routed back forever, ie adding something like > > if (!pid) { > skb_free(skb); > return -EINV