lkml.org 
[lkml]   [2018]   [Mar]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 41/63] netfilter: use skb_to_full_sk in ip_route_me_harder
    Date
    4.4-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Florian Westphal <fw@strlen.de>

    commit 29e09229d9f26129a39462fae0ddabc4d9533989 upstream.

    inet_sk(skb->sk) is illegal in case skb is attached to request socket.

    Fixes: ca6fb0651883 ("tcp: attach SYNACK messages to request sockets instead of listener")
    Reported by: Daniel J Blueman <daniel@quora.org>
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Tested-by: Daniel J Blueman <daniel@quora.org>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    net/ipv4/netfilter.c | 7 ++++---
    1 file changed, 4 insertions(+), 3 deletions(-)

    --- a/net/ipv4/netfilter.c
    +++ b/net/ipv4/netfilter.c
    @@ -23,7 +23,8 @@ int ip_route_me_harder(struct net *net,
    struct rtable *rt;
    struct flowi4 fl4 = {};
    __be32 saddr = iph->saddr;
    - __u8 flags = skb->sk ? inet_sk_flowi_flags(skb->sk) : 0;
    + const struct sock *sk = skb_to_full_sk(skb);
    + __u8 flags = sk ? inet_sk_flowi_flags(sk) : 0;
    unsigned int hh_len;

    if (addr_type == RTN_UNSPEC)
    @@ -39,7 +40,7 @@ int ip_route_me_harder(struct net *net,
    fl4.daddr = iph->daddr;
    fl4.saddr = saddr;
    fl4.flowi4_tos = RT_TOS(iph->tos);
    - fl4.flowi4_oif = skb->sk ? skb->sk->sk_bound_dev_if : 0;
    + fl4.flowi4_oif = sk ? sk->sk_bound_dev_if : 0;
    fl4.flowi4_mark = skb->mark;
    fl4.flowi4_flags = flags;
    rt = ip_route_output_key(net, &fl4);
    @@ -58,7 +59,7 @@ int ip_route_me_harder(struct net *net,
    xfrm_decode_session(skb, flowi4_to_flowi(&fl4), AF_INET) == 0) {
    struct dst_entry *dst = skb_dst(skb);
    skb_dst_set(skb, NULL);
    - dst = xfrm_lookup(net, dst, flowi4_to_flowi(&fl4), skb->sk, 0);
    + dst = xfrm_lookup(net, dst, flowi4_to_flowi(&fl4), sk, 0);
    if (IS_ERR(dst))
    return PTR_ERR(dst);
    skb_dst_set(skb, dst);

    \
     
     \ /
      Last update: 2018-03-16 18:25    [W:4.537 / U:0.052 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site