From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Florian Westphal <fw@strlen.de>,
Daniel J Blueman <daniel@quora.org>,
Pablo Neira Ayuso <pablo@netfilter.org>
Subject: [PATCH 4.4 41/63] netfilter: use skb_to_full_sk in ip_route_me_harder
Date: Fri, 16 Mar 2018 16:23:13 +0100 [thread overview]
Message-ID: <20180316152304.521252528@linuxfoundation.org> (raw)
In-Reply-To: <20180316152259.964532775@linuxfoundation.org>
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
commit 29e09229d9f26129a39462fae0ddabc4d9533989 upstream.
inet_sk(skb->sk) is illegal in case skb is attached to request socket.
Fixes: ca6fb0651883 ("tcp: attach SYNACK messages to request sockets instead of listener")
Reported by: Daniel J Blueman <daniel@quora.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Tested-by: Daniel J Blueman <daniel@quora.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/netfilter.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/net/ipv4/netfilter.c
+++ b/net/ipv4/netfilter.c
@@ -23,7 +23,8 @@ int ip_route_me_harder(struct net *net,
struct rtable *rt;
struct flowi4 fl4 = {};
__be32 saddr = iph->saddr;
- __u8 flags = skb->sk ? inet_sk_flowi_flags(skb->sk) : 0;
+ const struct sock *sk = skb_to_full_sk(skb);
+ __u8 flags = sk ? inet_sk_flowi_flags(sk) : 0;
unsigned int hh_len;
if (addr_type == RTN_UNSPEC)
@@ -39,7 +40,7 @@ int ip_route_me_harder(struct net *net,
fl4.daddr = iph->daddr;
fl4.saddr = saddr;
fl4.flowi4_tos = RT_TOS(iph->tos);
- fl4.flowi4_oif = skb->sk ? skb->sk->sk_bound_dev_if : 0;
+ fl4.flowi4_oif = sk ? sk->sk_bound_dev_if : 0;
fl4.flowi4_mark = skb->mark;
fl4.flowi4_flags = flags;
rt = ip_route_output_key(net, &fl4);
@@ -58,7 +59,7 @@ int ip_route_me_harder(struct net *net,
xfrm_decode_session(skb, flowi4_to_flowi(&fl4), AF_INET) == 0) {
struct dst_entry *dst = skb_dst(skb);
skb_dst_set(skb, NULL);
- dst = xfrm_lookup(net, dst, flowi4_to_flowi(&fl4), skb->sk, 0);
+ dst = xfrm_lookup(net, dst, flowi4_to_flowi(&fl4), sk, 0);
if (IS_ERR(dst))
return PTR_ERR(dst);
skb_dst_set(skb, dst);
next prev parent reply other threads:[~2018-03-16 15:23 UTC|newest]
Thread overview: 79+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-03-16 15:22 [PATCH 4.4 00/63] 4.4.122-stable review Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 01/63] RDMA/ucma: Limit possible option size Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 02/63] RDMA/ucma: Check that user doesnt overflow QP state Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 03/63] RDMA/mlx5: Fix integer overflow while resizing CQ Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 04/63] scsi: qla2xxx: Fix NULL pointer crash due to active timer for ABTS Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 05/63] workqueue: Allow retrieval of current tasks work struct Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 06/63] drm: Allow determining if current task is output poll worker Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 07/63] drm/nouveau: Fix deadlock on runtime suspend Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 08/63] drm/radeon: " Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 09/63] drm/amdgpu: " Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 10/63] drm/amdgpu: Notify sbios device ready before send request Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 11/63] drm/radeon: fix KV harvesting Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 12/63] drm/amdgpu: " Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 13/63] MIPS: BMIPS: Do not mask IPIs during suspend Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 14/63] MIPS: ath25: Check for kzalloc allocation failure Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 15/63] MIPS: OCTEON: irq: Check for null return on kzalloc allocation Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 16/63] Input: matrix_keypad - fix race when disabling interrupts Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 17/63] loop: Fix lost writes caused by missing flag Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 18/63] kbuild: Handle builtin dtb file names containing hyphens Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 19/63] bcache: dont attach backing with duplicate UUID Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 20/63] x86/MCE: Serialize sysfs changes Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 21/63] ALSA: hda/realtek - Fix dock line-out volume on Dell Precision 7520 Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 22/63] ALSA: seq: Dont allow resizing pool in use Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 23/63] ALSA: seq: More protection for concurrent write and ioctl races Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 24/63] ALSA: hda: add dock and led support for HP EliteBook 820 G3 Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 25/63] ALSA: hda: add dock and led support for HP ProBook 640 G2 Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 26/63] nospec: Include <asm/barrier.h> dependency Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 27/63] watchdog: hpwdt: SMBIOS check Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 28/63] watchdog: hpwdt: Check source of NMI Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 29/63] watchdog: hpwdt: fix unused variable warning Greg Kroah-Hartman
2018-03-16 22:55 ` Jerry Hoemann
2018-03-18 10:14 ` Greg Kroah-Hartman
2018-03-20 23:19 ` Ben Hutchings
2018-03-21 11:11 ` 王金浦
2018-03-21 18:18 ` Guenter Roeck
2018-03-22 11:08 ` 王金浦
2018-04-06 7:51 ` Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 30/63] netfilter: nfnetlink_queue: fix timestamp attribute Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 31/63] ARM: omap2: hide omap3_save_secure_ram on non-OMAP3 builds Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 32/63] Input: tca8418_keypad - remove double read of key event register Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 33/63] [media] tc358743: fix register i2c_rd/wr function fix Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 34/63] netfilter: add back stackpointer size checks Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 35/63] netfilter: x_tables: fix missing timer initialization in xt_LED Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 36/63] netfilter: nat: cope with negative port range Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 37/63] netfilter: IDLETIMER: be syzkaller friendly Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 38/63] netfilter: ebtables: CONFIG_COMPAT: dont trust userland offsets Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 39/63] netfilter: bridge: ebt_among: add missing match size checks Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 40/63] netfilter: ipv6: fix use-after-free Write in nf_nat_ipv6_manip_pkt Greg Kroah-Hartman
2018-03-16 15:23 ` Greg Kroah-Hartman [this message]
2018-03-16 15:23 ` [PATCH 4.4 42/63] netfilter: x_tables: pass xt_counters struct instead of packet counter Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 43/63] netfilter: x_tables: pass xt_counters struct to counter allocator Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 44/63] netfilter: x_tables: pack percpu counter allocations Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 45/63] ext4: inplace xattr block update fails to deduplicate blocks Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 46/63] ubi: Fix race condition between ubi volume creation and udev Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 47/63] scsi: qla2xxx: Replace fcport alloc with qla2x00_alloc_fcport Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 48/63] NFS: Fix an incorrect type in struct nfs_direct_req Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 49/63] Revert "ARM: dts: LogicPD Torpedo: Fix I2C1 pinmux" Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 50/63] x86/module: Detect and skip invalid relocations Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 51/63] x86: Treat R_X86_64_PLT32 as R_X86_64_PC32 Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 52/63] serial: sh-sci: prevent lockup on full TTY buffers Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 53/63] tty/serial: atmel: add new version check for usart Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 54/63] uas: fix comparison for error code Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 55/63] staging: comedi: fix comedi_nsamples_left Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 56/63] staging: android: ashmem: Fix lockdep issue during llseek Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 57/63] USB: storage: Add JMicron bridge 152d:2567 to unusual_devs.h Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 58/63] usb: quirks: add control message delay for 1b1c:1b20 Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 59/63] USB: usbmon: remove assignment from IS_ERR argument Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 60/63] usb: usbmon: Read text within supplied buffer size Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 61/63] usb: gadget: f_fs: Fix use-after-free in ffs_fs_kill_sb() Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 62/63] serial: 8250_pci: Add Brainboxes UC-260 4 port serial device Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 63/63] fixup: sctp: verify size of a new chunk in _sctp_make_chunk() Greg Kroah-Hartman
2018-03-16 18:05 ` [PATCH 4.4 00/63] 4.4.122-stable review Nathan Chancellor
2018-03-18 10:16 ` Greg Kroah-Hartman
2018-03-28 10:00 ` Greg Kroah-Hartman
2018-03-16 23:20 ` kernelci.org bot
2018-03-17 10:11 ` Naresh Kamboju
2018-03-17 10:21 ` Naresh Kamboju
2018-03-18 10:30 ` Greg Kroah-Hartman
2018-03-17 14:40 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180316152304.521252528@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=daniel@quora.org \
--cc=fw@strlen.de \
--cc=linux-kernel@vger.kernel.org \
--cc=pablo@netfilter.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).