lkml.org 
[lkml]   [2021]   [Nov]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 172/251] netfilter: nfnetlink_queue: fix OOB when mac header was cleared
    Date
    From: Florian Westphal <fw@strlen.de>

    [ Upstream commit 5648b5e1169ff1d6d6a46c35c0b5fbebd2a5cbb2 ]

    On 64bit platforms the MAC header is set to 0xffff on allocation and
    also when a helper like skb_unset_mac_header() is called.

    dev_parse_header may call skb_mac_header() which assumes valid mac offset:

    BUG: KASAN: use-after-free in eth_header_parse+0x75/0x90
    Read of size 6 at addr ffff8881075a5c05 by task nf-queue/1364
    Call Trace:
    memcpy+0x20/0x60
    eth_header_parse+0x75/0x90
    __nfqnl_enqueue_packet+0x1a61/0x3380
    __nf_queue+0x597/0x1300
    nf_queue+0xf/0x40
    nf_hook_slow+0xed/0x190
    nf_hook+0x184/0x440
    ip_output+0x1c0/0x2a0
    nf_reinject+0x26f/0x700
    nfqnl_recv_verdict+0xa16/0x18b0
    nfnetlink_rcv_msg+0x506/0xe70

    The existing code only works if the skb has a mac header.

    Fixes: 2c38de4c1f8da7 ("netfilter: fix looped (broad|multi)cast's MAC handling")
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/netfilter/nfnetlink_queue.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
    index 02bbc2f9f1f1e..13e67eb75d841 100644
    --- a/net/netfilter/nfnetlink_queue.c
    +++ b/net/netfilter/nfnetlink_queue.c
    @@ -543,7 +543,7 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
    goto nla_put_failure;

    if (indev && entskb->dev &&
    - entskb->mac_header != entskb->network_header) {
    + skb_mac_header_was_set(entskb)) {
    struct nfqnl_msg_packet_hw phw;
    int len;

    --
    2.33.0


    \
     
     \ /
      Last update: 2022-09-17 16:12    [W:4.561 / U:0.496 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site