lkml.org 
[lkml]   [2021]   [Dec]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 14/76] netfilter: fix regression in looped (broad|multi)casts MAC handling
    Date
    From: Ignacy Gawędzki <ignacy.gawedzki@green-communications.fr>

    [ Upstream commit ebb966d3bdfed581ecccbb4a7432341baf7619b4 ]

    In commit 5648b5e1169f ("netfilter: nfnetlink_queue: fix OOB when mac
    header was cleared"), the test for non-empty MAC header introduced in
    commit 2c38de4c1f8da7 ("netfilter: fix looped (broad|multi)cast's MAC
    handling") has been replaced with a test for a set MAC header.

    This breaks the case when the MAC header has been reset (using
    skb_reset_mac_header), as is the case with looped-back multicast
    packets. As a result, the packets ending up in NFQUEUE get a bogus
    hwaddr interpreted from the first bytes of the IP header.

    This patch adds a test for a non-empty MAC header in addition to the
    test for a set MAC header. The same two tests are also implemented in
    nfnetlink_log.c, where the initial code of commit 2c38de4c1f8da7
    ("netfilter: fix looped (broad|multi)cast's MAC handling") has not been
    touched, but where supposedly the same situation may happen.

    Fixes: 5648b5e1169f ("netfilter: nfnetlink_queue: fix OOB when mac header was cleared")
    Signed-off-by: Ignacy Gawędzki <ignacy.gawedzki@green-communications.fr>
    Reviewed-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/netfilter/nfnetlink_log.c | 3 ++-
    net/netfilter/nfnetlink_queue.c | 3 ++-
    2 files changed, 4 insertions(+), 2 deletions(-)

    diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
    index b35e8d9a5b37e..33c13edbca4bb 100644
    --- a/net/netfilter/nfnetlink_log.c
    +++ b/net/netfilter/nfnetlink_log.c
    @@ -557,7 +557,8 @@ __build_packet_message(struct nfnl_log_net *log,
    goto nla_put_failure;

    if (indev && skb->dev &&
    - skb->mac_header != skb->network_header) {
    + skb_mac_header_was_set(skb) &&
    + skb_mac_header_len(skb) != 0) {
    struct nfulnl_msg_packet_hw phw;
    int len;

    diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
    index 98994fe677fe9..b0358f30947ea 100644
    --- a/net/netfilter/nfnetlink_queue.c
    +++ b/net/netfilter/nfnetlink_queue.c
    @@ -562,7 +562,8 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
    goto nla_put_failure;

    if (indev && entskb->dev &&
    - skb_mac_header_was_set(entskb)) {
    + skb_mac_header_was_set(entskb) &&
    + skb_mac_header_len(entskb) != 0) {
    struct nfqnl_msg_packet_hw phw;
    int len;

    --
    2.34.1


    \
     
     \ /
      Last update: 2021-12-27 16:38    [W:4.070 / U:1.440 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site