Netdev Archive on
 help / color / Atom feed
From: Pablo Neira Ayuso <>
Subject: [PATCH 2/2] netfilter: nf_reject_ipv4: Fix use-after-free in send_reset
Date: Wed,  1 Nov 2017 19:48:12 +0100
Message-ID: <> (raw)
In-Reply-To: <>

From: Tejaswi Tanikella <>

niph is not updated after pskb_expand_head changes the skb head. It
still points to the freed data, which is then used to update tot_len and
checksum. This could cause use-after-free poison crash.

Update niph, if ip_route_me_harder does not fail.

This only affects the interaction with REJECT targets and br_netfilter.

Signed-off-by: Tejaswi Tanikella <>
Signed-off-by: Pablo Neira Ayuso <>
 net/ipv4/netfilter/nf_reject_ipv4.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/ipv4/netfilter/nf_reject_ipv4.c b/net/ipv4/netfilter/nf_reject_ipv4.c
index eeacbdaf7cdf..5cd06ba3535d 100644
--- a/net/ipv4/netfilter/nf_reject_ipv4.c
+++ b/net/ipv4/netfilter/nf_reject_ipv4.c
@@ -132,6 +132,8 @@ void nf_send_reset(struct net *net, struct sk_buff *oldskb, int hook)
 	if (ip_route_me_harder(net, nskb, RTN_UNSPEC))
 		goto free_nskb;
+	niph = ip_hdr(nskb);
 	/* "Never happens" */
 	if (nskb->len > dst_mtu(skb_dst(nskb)))
 		goto free_nskb;

  parent reply index

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-11-01 18:48 [PATCH 0/2] Netfilter fixes for net Pablo Neira Ayuso
2017-11-01 18:48 ` [PATCH 1/2] netfilter: nft_set_hash: disable fast_ops for 2-len keys Pablo Neira Ayuso
2017-11-01 18:48 ` Pablo Neira Ayuso [this message]
2017-11-02  7:53 ` [PATCH 0/2] Netfilter fixes for net David Miller

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Netdev Archive on

Archives are clonable:
	git clone --mirror netdev/git/0.git
	git clone --mirror netdev/git/1.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 netdev netdev/ \
	public-inbox-index netdev

Newsgroup available over NNTP:

AGPL code for this site: git clone public-inbox