Re: [Security] [PATCH] infinite recursion in netlink

2007-04-26 Thread Chris Wright
* Chris Wright ([EMAIL PROTECTED]) wrote: * Greg KH ([EMAIL PROTECTED]) wrote: fyi, here's the patch that I applied, perhaps 2.6.20 needed something else too? snip @@ -809,7 +815,7 @@ static void nl_fib_input(struct sock *sk nl_fib_lookup(frn, tb); - pid =

Re: [Security] [PATCH] infinite recursion in netlink

2007-04-26 Thread David Miller
From: Chris Wright [EMAIL PROTECTED] Date: Wed, 25 Apr 2007 23:26:01 -0700 Working fine here. Any chance you booted a stale kernel? If not, what's your nl_fib_input+0xe4. Any chance that's actually in nl_fib_lookup? I'm seriously hoping it's a stale kernel or similar, because I can't

Re: [Security] [PATCH] infinite recursion in netlink

2007-04-26 Thread Greg KH
On Wed, Apr 25, 2007 at 11:31:21PM -0700, David Miller wrote: From: Chris Wright [EMAIL PROTECTED] Date: Wed, 25 Apr 2007 23:26:01 -0700 Working fine here. Any chance you booted a stale kernel? If not, what's your nl_fib_input+0xe4. Any chance that's actually in nl_fib_lookup? I'm

Re: [Security] [PATCH] infinite recursion in netlink

2007-04-26 Thread David Miller
From: Greg KH [EMAIL PROTECTED] Date: Wed, 25 Apr 2007 23:51:51 -0700 Sorry for the false alarm, I have no idea what when wrong here. Glad the bug is really fixed. Nothing to be sorry about, it's great that you double checked things even if it turned out to be a false alarm in the end. - To

Re: [Security] [PATCH] infinite recursion in netlink

2007-04-25 Thread Linus Torvalds
On Wed, 25 Apr 2007, Alexey Kuznetsov wrote: Reply to NETLINK_FIB_LOOKUP messages were misrouted back to kernel, which resulted in infinite recursion and stack overflow. So I assume it's this line that actually _fixes_ it: - pid = nlh-nlmsg_pid; /*pid of sending process */

Re: [Security] [PATCH] infinite recursion in netlink

2007-04-25 Thread David Miller
From: Linus Torvalds [EMAIL PROTECTED] Date: Wed, 25 Apr 2007 13:15:12 -0700 (PDT) If so, shouldn't we also have some safety-net to make sure it doesn't still get routed back forever, ie adding something like if (!pid) { skb_free(skb); return -EINVAL;

Re: [Security] [PATCH] infinite recursion in netlink

2007-04-25 Thread Greg KH
On Wed, Apr 25, 2007 at 01:15:12PM -0700, Linus Torvalds wrote: On Wed, 25 Apr 2007, Alexey Kuznetsov wrote: Reply to NETLINK_FIB_LOOKUP messages were misrouted back to kernel, which resulted in infinite recursion and stack overflow. Wait, I just had the bright idea of actually

Re: [Security] [PATCH] infinite recursion in netlink

2007-04-25 Thread David Miller
From: Greg KH [EMAIL PROTECTED] Date: Wed, 25 Apr 2007 22:29:12 -0700 On Wed, Apr 25, 2007 at 01:15:12PM -0700, Linus Torvalds wrote: On Wed, 25 Apr 2007, Alexey Kuznetsov wrote: Reply to NETLINK_FIB_LOOKUP messages were misrouted back to kernel, which resulted in infinite

Re: [Security] [PATCH] infinite recursion in netlink

2007-04-25 Thread Chris Wright
* Greg KH ([EMAIL PROTECTED]) wrote: On Wed, Apr 25, 2007 at 01:15:12PM -0700, Linus Torvalds wrote: On Wed, 25 Apr 2007, Alexey Kuznetsov wrote: Reply to NETLINK_FIB_LOOKUP messages were misrouted back to kernel, which resulted in infinite recursion and stack overflow. Wait,

Re: [Security] [PATCH] infinite recursion in netlink

2007-04-25 Thread Greg KH
On Wed, Apr 25, 2007 at 10:32:01PM -0700, David Miller wrote: From: Greg KH [EMAIL PROTECTED] Date: Wed, 25 Apr 2007 22:29:12 -0700 On Wed, Apr 25, 2007 at 01:15:12PM -0700, Linus Torvalds wrote: On Wed, 25 Apr 2007, Alexey Kuznetsov wrote: Reply to NETLINK_FIB_LOOKUP

Re: [Security] [PATCH] infinite recursion in netlink

2007-04-25 Thread Greg KH
On Wed, Apr 25, 2007 at 10:44:20PM -0700, Greg KH wrote: On Wed, Apr 25, 2007 at 10:32:01PM -0700, David Miller wrote: From: Greg KH [EMAIL PROTECTED] Date: Wed, 25 Apr 2007 22:29:12 -0700 On Wed, Apr 25, 2007 at 01:15:12PM -0700, Linus Torvalds wrote: On Wed, 25 Apr 2007,

Re: [Security] [PATCH] infinite recursion in netlink

2007-04-25 Thread Chris Wright
* Greg KH ([EMAIL PROTECTED]) wrote: fyi, here's the patch that I applied, perhaps 2.6.20 needed something else too? snip @@ -809,7 +815,7 @@ static void nl_fib_input(struct sock *sk nl_fib_lookup(frn, tb); - pid = nlh-nlmsg_pid; /*pid of sending process */ +