From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751157AbeAVRB7 (ORCPT ); Mon, 22 Jan 2018 12:01:59 -0500 Received: from aserp2120.oracle.com ([141.146.126.78]:46294 "EHLO aserp2120.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751028AbeAVRB5 (ORCPT ); Mon, 22 Jan 2018 12:01:57 -0500 Subject: Re: [PATCH] RDS: Fix rds-ping inducing kernel panic To: Kees Cook Cc: Honggang Li , linux-kernel@vger.kernel.org, Sowmini Varadhan , Steve Beattie , Andy Whitcroft , "David S. Miller" , Jay Fenlason , netdev@vger.kernel.org, linux-rdma@vger.kernel.org, rds-devel@oss.oracle.com References: <20180122112415.GA41074@beast> From: Santosh Shilimkar Organization: Oracle Corporation Message-ID: <2768ae2b-b7de-cf00-c599-4c164a6228be@oracle.com> Date: Mon, 22 Jan 2018 09:01:43 -0800 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.5.2 MIME-Version: 1.0 In-Reply-To: <20180122112415.GA41074@beast> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit X-Proofpoint-Virus-Version: vendor=nai engine=5900 definitions=8782 signatures=668655 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1711220000 definitions=main-1801220238 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 1/22/2018 3:24 AM, Kees Cook wrote: > As described in: https://bugzilla.redhat.com/show_bug.cgi?id=822754 > > Attempting an RDS connection from the IP address of an IPoIB interface > to itself causes a kernel panic due to a BUG_ON() being triggered. > Making the test less strict allows rds-ping to work without crashing > the machine. > > A local unprivileged user could use this flaw to crash the sytem. > Are you able to reproduce this issue on mainline kernel ? IIRC, this sjouldn't happen anymore but if you see it, please let me know. Will try it as well. rds-ping on self loopback device is often tested and used as well for monitoring services in production. > I think this fix was written by Jay Fenlason , > and extracted from the RedHat kernel patches here: > > https://oss.oracle.com/git/gitweb.cgi?p=redpatch.git;a=commitdiff;h=c7b6a0a1d8d636852be130fa15fa8be10d4704e8 > It was part of redhat patched kernel but not carried in shipping Oracle UEK kernels at least afaik. > This fix appears to have been carried by at least RedHat, Oracle, and > Ubuntu for several years. > > CVE-2012-2372 > > Reported-by: Honggang Li > Cc: stable@vger.kernel.org > Signed-off-by: Kees Cook > --- > This is what I get for researching CVE lifetimes... Am not sure if its applicable anymore. Infact the issue with loopback device was due to congestion update and thats been already addressed with commit '18fc25c94: {rds: prevent BUG_ON triggered on congestion update to loopback}' Regards, Santosh