Messages in this thread | | | Subject | Re: net: GPF in eth_header | From | Eric Dumazet <> | Date | Mon, 28 Nov 2016 14:14:04 -0800 |
| |
On Mon, 2016-11-28 at 22:34 +0100, Florian Westphal wrote: > Eric Dumazet <eric.dumazet@gmail.com> wrote: > > > Might be a bug added in commit daaa7d647f81f3 > > > ("netfilter: ipv6: avoid nf_iterate recursion") > > > > > > Florian, what do you think of dropping a packet that presumably was > > > mangled badly by nf_ct_frag6_queue() ? > > ipv4 definitely frees malformed packets. > In general, I think netfilter should avoid 'silent' drops if possible > and let skb continue, but of course such skbs should not be made worse > as what we ate to begin with... > > > > (Like about 48 byte pulled :(, and/or skb->csum changed ) > > I think this warrants a review of ipv6 reassembly too, bug reported here > is because ipv6 nf defrag is also done on output.
ip6_frag_queue() definitely frees bad/mangled skbs()
> Looks good, we'll need to change some of the errno return codes in > nf_ct_frag6_gather to 0 though for this to work, which should not be too > hard ;)
If the goal is to let buggy packets pass, then we might need to undo changes in nf_ct_frag6_queue()
| |