tcp: take care of truncations done by skfilter() With syzkaller help, Marco Grassi found a bug in TCP stack, crashing in tcpcollapse()
Root cause is that skfilter() can truncate the incoming skb, but TCP stack was not really expecting this to happen. It probably was expecting a simple DROP or ACCEPT behavior.
We first need to make sure no part of TCP header could be removed. Then we need to adjust TCPSKBCB(skb)->endseq
Many thanks to syzkaller team and Marco for giving us a reproducer.
Eh przegapiłem info, że znowu była podwyżka minimalnej. I znowu zarabiam tylko 500zł więcej od sprzątaczki. 10 lat nabijania doświadczenia, 10 lat pracy jako grafik z czego 6 lat wypruwania sobie żył w agencji reklamowej i wszystko c---a warte.
With syzkaller help, Marco Grassi found a bug in TCP stack,
crashing in tcpcollapse()
Root cause is that skfilter() can truncate the incoming skb,
but TCP stack was not really expecting this to happen.
It probably was expecting a simple DROP or ACCEPT behavior.
We first need to make sure no part of TCP header could be removed.
Then we need to adjust TCPSKBCB(skb)->endseq
Many thanks to syzkaller team and Marco for giving us a reproducer.
link do git kernel
#linux #unix #security #hackingnews #devops