* [PATCH net] ipv4: fix use-after-free in ip_cmsg_recv_dstaddr()
@ 2018-09-30 18:33 Eric Dumazet
2018-09-30 22:00 ` Willem de Bruijn
2018-10-03 5:32 ` David Miller
0 siblings, 2 replies; 3+ messages in thread
From: Eric Dumazet @ 2018-09-30 18:33 UTC (permalink / raw)
To: David S . Miller; +Cc: netdev, Eric Dumazet, Eric Dumazet, Willem de Bruijn
Caching ip_hdr(skb) before a call to pskb_may_pull() is buggy,
do not do it.
Fixes: 2efd4fca703a ("ip: in cmsg IP(V6)_ORIGDSTADDR call pskb_may_pull")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Willem de Bruijn <willemb@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
---
net/ipv4/ip_sockglue.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index c0fe5ad996f238091f5b9585adb586a571f653f0..26c36cccabdc2c8cc95cfd609672d412c493fc42 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -149,7 +149,6 @@ static void ip_cmsg_recv_security(struct msghdr *msg, struct sk_buff *skb)
static void ip_cmsg_recv_dstaddr(struct msghdr *msg, struct sk_buff *skb)
{
struct sockaddr_in sin;
- const struct iphdr *iph = ip_hdr(skb);
__be16 *ports;
int end;
@@ -164,7 +163,7 @@ static void ip_cmsg_recv_dstaddr(struct msghdr *msg, struct sk_buff *skb)
ports = (__be16 *)skb_transport_header(skb);
sin.sin_family = AF_INET;
- sin.sin_addr.s_addr = iph->daddr;
+ sin.sin_addr.s_addr = ip_hdr(skb)->daddr;
sin.sin_port = ports[1];
memset(sin.sin_zero, 0, sizeof(sin.sin_zero));
--
2.19.0.605.g01d371f741-goog
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH net] ipv4: fix use-after-free in ip_cmsg_recv_dstaddr()
2018-09-30 18:33 [PATCH net] ipv4: fix use-after-free in ip_cmsg_recv_dstaddr() Eric Dumazet
@ 2018-09-30 22:00 ` Willem de Bruijn
2018-10-03 5:32 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: Willem de Bruijn @ 2018-09-30 22:00 UTC (permalink / raw)
To: Eric Dumazet
Cc: David Miller, Network Development, Eric Dumazet, Willem de Bruijn
On Sun, Sep 30, 2018 at 2:37 PM Eric Dumazet <edumazet@google.com> wrote:
>
> Caching ip_hdr(skb) before a call to pskb_may_pull() is buggy,
> do not do it.
>
> Fixes: 2efd4fca703a ("ip: in cmsg IP(V6)_ORIGDSTADDR call pskb_may_pull")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Cc: Willem de Bruijn <willemb@google.com>
> Reported-by: syzbot <syzkaller@googlegroups.com>
Acked-by: Willem de Bruijn <willemb@google.com>
Argh, indeed. Thanks for fixing this, Eric.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH net] ipv4: fix use-after-free in ip_cmsg_recv_dstaddr()
2018-09-30 18:33 [PATCH net] ipv4: fix use-after-free in ip_cmsg_recv_dstaddr() Eric Dumazet
2018-09-30 22:00 ` Willem de Bruijn
@ 2018-10-03 5:32 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: David Miller @ 2018-10-03 5:32 UTC (permalink / raw)
To: edumazet; +Cc: netdev, eric.dumazet, willemb
From: Eric Dumazet <edumazet@google.com>
Date: Sun, 30 Sep 2018 11:33:39 -0700
> Caching ip_hdr(skb) before a call to pskb_may_pull() is buggy,
> do not do it.
>
> Fixes: 2efd4fca703a ("ip: in cmsg IP(V6)_ORIGDSTADDR call pskb_may_pull")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Cc: Willem de Bruijn <willemb@google.com>
> Reported-by: syzbot <syzkaller@googlegroups.com>
Applied and queued up for -stable.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2018-10-03 12:19 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-09-30 18:33 [PATCH net] ipv4: fix use-after-free in ip_cmsg_recv_dstaddr() Eric Dumazet
2018-09-30 22:00 ` Willem de Bruijn
2018-10-03 5:32 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.