CVE-2013-4563 -- Linux kernel: net: large udp packet over IPv6 over UFO-enabled device with TBF qdisc panic

[Petr Matousek <pmatouse () redhat com>]

Commit 1e2bd517c108816220f262d7954b697af03b5f9c ("udp6: Fix udp
fragmentation for tunnel traffic.") changed the calculation if
there is enough space to include a fragment header in the skb from a
skb->mac_header dervived one to skb_headroom. Because we already peeled
off the skb to transport_header this is wrong.

This fixes a panic Saran Neti reported. He used the tbf scheduler which
skb_gso_segments the skb. The offsets get negative and we panic in
memcpy because the skb was erroneously not expanded at the head.

Introduced by:
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1e2bd517c108816220f262d7954b697af03b5f9c

Introduced in:
v3.10-rc5

Upstream fix:
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0e033e0

References:
http://marc.info/?l=linux-netdev&m=138305762205012&w=2
https://bugzilla.redhat.com/show_bug.cgi?id=1030015

Acknowledgements:

Red Hat would like to thank Saran Neti of TELUS Security Labs for
reporting this issue.

Thanks,
-- 
Petr Matousek / Red Hat Security Response Team

Attachment: _bin
Description: