| From 0e07e25b481aa021e4b48085ecb8a049e9614510 Mon Sep 17 00:00:00 2001 |
| From: Pablo Neira Ayuso <pablo@netfilter.org> |
| Date: Tue, 30 Mar 2021 16:24:11 +0200 |
| Subject: netfilter: flowtable: fix NAT IPv6 offload mangling |
| |
| From: Pablo Neira Ayuso <pablo@netfilter.org> |
| |
| commit 0e07e25b481aa021e4b48085ecb8a049e9614510 upstream. |
| |
| Fix out-of-bound access in the address array. |
| |
| Fixes: 5c27d8d76ce8 ("netfilter: nf_flow_table_offload: add IPv6 support") |
| Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| net/netfilter/nf_flow_table_offload.c | 6 +++--- |
| 1 file changed, 3 insertions(+), 3 deletions(-) |
| |
| --- a/net/netfilter/nf_flow_table_offload.c |
| +++ b/net/netfilter/nf_flow_table_offload.c |
| @@ -305,12 +305,12 @@ static void flow_offload_ipv6_mangle(str |
| const __be32 *addr, const __be32 *mask) |
| { |
| struct flow_action_entry *entry; |
| - int i; |
| + int i, j; |
| |
| - for (i = 0; i < sizeof(struct in6_addr) / sizeof(u32); i += sizeof(u32)) { |
| + for (i = 0, j = 0; i < sizeof(struct in6_addr) / sizeof(u32); i += sizeof(u32), j++) { |
| entry = flow_action_entry_next(flow_rule); |
| flow_offload_mangle(entry, FLOW_ACT_MANGLE_HDR_TYPE_IP6, |
| - offset + i, &addr[i], mask); |
| + offset + i, &addr[j], mask); |
| } |
| } |
| |