| From foo@baz Sat Jan 26 11:08:02 CET 2019 |
| From: Ross Lagerwall <ross.lagerwall@citrix.com> |
| Date: Thu, 17 Jan 2019 15:34:38 +0000 |
| Subject: net: Fix usage of pskb_trim_rcsum |
| |
| From: Ross Lagerwall <ross.lagerwall@citrix.com> |
| |
| [ Upstream commit 6c57f0458022298e4da1729c67bd33ce41c14e7a ] |
| |
| In certain cases, pskb_trim_rcsum() may change skb pointers. |
| Reinitialize header pointers afterwards to avoid potential |
| use-after-frees. Add a note in the documentation of |
| pskb_trim_rcsum(). Found by KASAN. |
| |
| Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/net/ppp/pppoe.c | 1 + |
| include/linux/skbuff.h | 1 + |
| net/bridge/br_netfilter_ipv6.c | 1 + |
| net/bridge/netfilter/nft_reject_bridge.c | 1 + |
| net/ipv4/ip_input.c | 1 + |
| 5 files changed, 5 insertions(+) |
| |
| --- a/drivers/net/ppp/pppoe.c |
| +++ b/drivers/net/ppp/pppoe.c |
| @@ -442,6 +442,7 @@ static int pppoe_rcv(struct sk_buff *skb |
| if (pskb_trim_rcsum(skb, len)) |
| goto drop; |
| |
| + ph = pppoe_hdr(skb); |
| pn = pppoe_pernet(dev_net(dev)); |
| |
| /* Note that get_item does a sock_hold(), so sk_pppox(po) |
| --- a/include/linux/skbuff.h |
| +++ b/include/linux/skbuff.h |
| @@ -2798,6 +2798,7 @@ static inline unsigned char *skb_push_rc |
| * |
| * This is exactly the same as pskb_trim except that it ensures the |
| * checksum of received packets are still valid after the operation. |
| + * It can change skb pointers. |
| */ |
| |
| static inline int pskb_trim_rcsum(struct sk_buff *skb, unsigned int len) |
| --- a/net/bridge/br_netfilter_ipv6.c |
| +++ b/net/bridge/br_netfilter_ipv6.c |
| @@ -131,6 +131,7 @@ int br_validate_ipv6(struct net *net, st |
| IPSTATS_MIB_INDISCARDS); |
| goto drop; |
| } |
| + hdr = ipv6_hdr(skb); |
| } |
| if (hdr->nexthdr == NEXTHDR_HOP && br_nf_check_hbh_len(skb)) |
| goto drop; |
| --- a/net/bridge/netfilter/nft_reject_bridge.c |
| +++ b/net/bridge/netfilter/nft_reject_bridge.c |
| @@ -192,6 +192,7 @@ static bool reject6_br_csum_ok(struct sk |
| pskb_trim_rcsum(skb, ntohs(ip6h->payload_len) + sizeof(*ip6h))) |
| return false; |
| |
| + ip6h = ipv6_hdr(skb); |
| thoff = ipv6_skip_exthdr(skb, ((u8*)(ip6h+1) - skb->data), &proto, &fo); |
| if (thoff < 0 || thoff >= skb->len || (fo & htons(~0x7)) != 0) |
| return false; |
| --- a/net/ipv4/ip_input.c |
| +++ b/net/ipv4/ip_input.c |
| @@ -444,6 +444,7 @@ int ip_rcv(struct sk_buff *skb, struct n |
| goto drop; |
| } |
| |
| + iph = ip_hdr(skb); |
| skb->transport_header = skb->network_header + iph->ihl*4; |
| |
| /* Remove any debris in the socket control block */ |