Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1604959

[PATCH 4.10 43/63] ipv6: avoid write to a possibly cloned skb

Show all headers | View raw

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Florian Westphal <fw@strlen.de>


[ Upstream commit 79e49503efe53a8c51d8b695bedc8a346c5e4a87 ]

ip6_fragment, in case skb has a fraglist, checks if the
skb is cloned.  If it is, it will move to the 'slow path' and allocates
new skbs for each fragment.

However, right before entering the slowpath loop, it updates the
nexthdr value of the last ipv6 extension header to NEXTHDR_FRAGMENT,
to account for the fragment header that will be inserted in the new
ipv6-fragment skbs.

In case original skb is cloned this munges nexthdr value of another
skb.  Avoid this by doing the nexthdr update for each of the new fragment
skbs separately.

This was observed with tcpdump on a bridge device where netfilter ipv6
reassembly is active:  tcpdump shows malformed fragment headers as
the l4 header (icmpv6, tcp, etc). is decoded as a fragment header.

Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
Reported-by: Andreas Karis <akaris@redhat.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv6/ip6_output.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -767,13 +767,14 @@ slow_path:
 	 *	Fragment the datagram.
 	 */
 
-	*prevhdr = NEXTHDR_FRAGMENT;
 	troom = rt->dst.dev->needed_tailroom;
 
 	/*
 	 *	Keep copying data until we run out.
 	 */
 	while (left > 0)	{
+		u8 *fragnexthdr_offset;
+
 		len = left;
 		/* IF: it doesn't fit, use 'mtu' - the data space left */
 		if (len > mtu)
@@ -818,6 +819,10 @@ slow_path:
 		 */
 		skb_copy_from_linear_data(skb, skb_network_header(frag), hlen);
 
+		fragnexthdr_offset = skb_network_header(frag);
+		fragnexthdr_offset += prevhdr - skb_network_header(skb);
+		*fragnexthdr_offset = NEXTHDR_FRAGMENT;
+
 		/*
 		 *	Build fragment header.
 		 */

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.10 00/63] 4.10.5-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:10 +0100
  [PATCH 4.10 31/63] net: fix socket refcounting in skb_complete_tx_timestamp() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:10 +0100
  [PATCH 4.10 33/63] dccp: fix use-after-free in dccp_feat_activate_values Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:10 +0100
  [PATCH 4.10 32/63] net/sched: act_skbmod: remove unneeded rcu_read_unlock in tcf_skbmod_dump Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:10 +0100
  [PATCH 4.10 08/63] vti6: return GRE_KEY for vti6 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:10 +0100
  [PATCH 4.10 07/63] vxlan: correctly validate VXLAN ID against VXLAN_N_VID Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:10 +0100
  [PATCH 4.10 13/63] net sched actions: decrement module reference count after table flush. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:10 +0100
  [PATCH 4.10 06/63] sctp: deny peeloff operation on asocs with threads sleeping on it Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:10 +0100
  [PATCH 4.10 35/63] vrf: Fix use-after-free in vrf_xmit Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:10 +0100
  [PATCH 4.10 16/63] geneve: lock RCU on TX path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:10 +0100
  [PATCH 4.10 21/63] net: net_enable_timestamp() can be called from irq contexts Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:10 +0100
  [PATCH 4.10 40/63] mpls: Send route delete notifications when router module is unloaded Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:10 +0100
  [PATCH 4.10 36/63] net/tunnel: set inner protocol in network gro hooks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:10 +0100
  [PATCH 4.10 29/63] tcp: fix various issues for sockets morphing to listen state Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:10 +0100
  [PATCH 4.10 27/63] bonding: use ETH_MAX_MTU as max mtu Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:10 +0100
  [PATCH 4.10 17/63] mlxsw: spectrum_router: Avoid potential packets loss Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
  [PATCH 4.10 59/63] futex: Fix potential use-after-free in FUTEX_REQUEUE_PI Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
  [PATCH 4.10 38/63] amd-xgbe: Enable IRQs only if napi_complete_done() is true Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
  [PATCH 4.10 60/63] futex: Add missing error handling to FUTEX_REQUEUE_PI Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
  [PATCH 4.10 22/63] ipv6: orphan skbs in reassembly unit Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
  [PATCH 4.10 56/63] x86/kasan: Fix boot with KASAN=y and PROFILE_ANNOTATED_BRANCHES=y Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
  [PATCH 4.10 49/63] arm64: KVM: VHE: Clear HCR_TGE when invalidating guest TLBs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
  [PATCH 4.10 05/63] net/mlx5e: Fix wrong CQE decompression Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
  [PATCH 4.10 09/63] vxlan: dont allow overwrite of config src addr Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
  [PATCH 4.10 43/63] ipv6: avoid write to a possibly cloned skb Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
  [PATCH 4.10 61/63] locking/rwsem: Fix down_write_killable() for CONFIG_RWSEM_GENERIC_SPINLOCK=y Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
  [PATCH 4.10 41/63] mpls: Do not decrement alive counter for unregister events Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
  [PATCH 4.10 15/63] vxlan: lock RCU on TX path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
  [PATCH 4.10 03/63] net/mlx5e: Fix broken CQE compression initialization Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
  [PATCH 4.10 37/63] uapi: fix linux/packet_diag.h userspace compilation error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
  [PATCH 4.10 50/63] irqchip/gicv3-its: Add workaround for QDF2400 ITS erratum 0065 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
  [PATCH 4.10 26/63] amd-xgbe: Dont overwrite SFP PHY mod_absent settings Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
  [PATCH 4.10 12/63] sctp: set sin_port for addr param when checking duplicate address Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
  [PATCH 4.10 23/63] dccp: Unlock sock before calling sk_free() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
  [PATCH 4.10 04/63] net/mlx5e: Update MPWQE stride size when modifying CQE compress state Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
  [PATCH 4.10 10/63] ipv4: add missing initialization for flowi4_uid Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
  [PATCH 4.10 62/63] crypto: powerpc - Fix initialisation of crc32c context Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
  [PATCH 4.10 25/63] amd-xgbe: Be sure to set MDIO modes on device (re)start Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:20 +0100
  Re: [PATCH 4.10 00/63] 4.10.5-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-03-21 01:20 +0100
    Re: [PATCH 4.10 00/63] 4.10.5-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-21 05:40 +0100
  Re: [PATCH 4.10 00/63] 4.10.5-stable review Guenter Roeck <linux@roeck-us.net> - 2017-03-21 03:20 +0100
    Re: [PATCH 4.10 00/63] 4.10.5-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-21 05:50 +0100

csiph-web