From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.5 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 617CBC43387 for ; Fri, 11 Jan 2019 15:08:25 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 3167620874 for ; Fri, 11 Jan 2019 15:08:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1547219305; bh=qFpMlOpZh/OfMK+xE2qZNvRT53ArL+DNezVQX8PXXMc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=AtRlN6HpSV9IAXVwp7mTIy7aq2i70cncGzpGY6Daw+JANxJYRwC91l4PCdo4IICgr fMowwP/T1xmxnql11APE/f76grlJ6cR5x3pl3e9vpkRz4LGOEB7KebmtgzUKj2I7Rw /G/qFEdY9VeQWCShwiUcFWkvm/FLdw+WXajmaOWc= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388131AbfAKO2B (ORCPT ); Fri, 11 Jan 2019 09:28:01 -0500 Received: from mail.kernel.org ([198.145.29.99]:46484 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730371AbfAKO2A (ORCPT ); Fri, 11 Jan 2019 09:28:00 -0500 Received: from localhost (5356596B.cm-6-7b.dynamic.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 3E4192177B; Fri, 11 Jan 2019 14:27:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1547216879; bh=qFpMlOpZh/OfMK+xE2qZNvRT53ArL+DNezVQX8PXXMc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Q+1Nt9RojEwH6mWS98BnFhHmTWyj374GWLMWYtERg2u1Mce/6IP8xoNTEtfQRKlJG ypE2ACU80Pbyy9k5ND5cF7jTtD+LSOeEjuPVz06CzEQA1OET7fhnQxWuP6TVxJ/0F3 ySxBDEzqc9ZLuBtxOXD7y/1JL0T6UQ0KNc7iC+Us= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Neel Mehta , Shane Huntley , Heather Adkins , Florian Westphal , Pablo Neira Ayuso , Sasha Levin Subject: [PATCH 4.9 08/63] netfilter: seqadj: re-load tcp header pointer after possible head reallocation Date: Fri, 11 Jan 2019 15:14:11 +0100 Message-Id: <20190111131047.484989218@linuxfoundation.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20190111131046.387528003@linuxfoundation.org> References: <20190111131046.387528003@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org 4.9-stable review patch. If anyone has any objections, please let me know. ------------------ [ Upstream commit 530aad77010b81526586dfc09130ec875cd084e4 ] When adjusting sack block sequence numbers, skb_make_writable() gets called to make sure tcp options are all in the linear area, and buffer is not shared. This can cause tcp header pointer to get reallocated, so we must reaload it to avoid memory corruption. This bug pre-dates git history. Reported-by: Neel Mehta Reported-by: Shane Huntley Reported-by: Heather Adkins Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin --- net/netfilter/nf_conntrack_seqadj.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/net/netfilter/nf_conntrack_seqadj.c b/net/netfilter/nf_conntrack_seqadj.c index ef7063eced7c..dad08b9eaf62 100644 --- a/net/netfilter/nf_conntrack_seqadj.c +++ b/net/netfilter/nf_conntrack_seqadj.c @@ -115,12 +115,12 @@ static void nf_ct_sack_block_adjust(struct sk_buff *skb, /* TCP SACK sequence number adjustment */ static unsigned int nf_ct_sack_adjust(struct sk_buff *skb, unsigned int protoff, - struct tcphdr *tcph, struct nf_conn *ct, enum ip_conntrack_info ctinfo) { - unsigned int dir, optoff, optend; + struct tcphdr *tcph = (void *)skb->data + protoff; struct nf_conn_seqadj *seqadj = nfct_seqadj(ct); + unsigned int dir, optoff, optend; optoff = protoff + sizeof(struct tcphdr); optend = protoff + tcph->doff * 4; @@ -128,6 +128,7 @@ static unsigned int nf_ct_sack_adjust(struct sk_buff *skb, if (!skb_make_writable(skb, optend)) return 0; + tcph = (void *)skb->data + protoff; dir = CTINFO2DIR(ctinfo); while (optoff < optend) { @@ -207,7 +208,7 @@ int nf_ct_seq_adjust(struct sk_buff *skb, ntohl(newack)); tcph->ack_seq = newack; - res = nf_ct_sack_adjust(skb, protoff, tcph, ct, ctinfo); + res = nf_ct_sack_adjust(skb, protoff, ct, ctinfo); out: spin_unlock_bh(&ct->lock); -- 2.19.1