Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 29e09229 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: use skb_to_full_sk in ip_route_me_harder 



inet_sk(skb->sk) is illegal in case skb is attached to request socket.

Fixes: ca6fb065 ("tcp: attach SYNACK messages to request sockets instead of listener")
Reported by: Daniel J Blueman <daniel@quora.org>
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Tested-by: default avatarDaniel J Blueman <daniel@quora.org>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 2f44f752

net/ipv4/netfilter.c

+4 −3
Original line number Diff line number Diff line
@@ -23,7 +23,8 @@ int ip_route_me_harder(struct net *net, struct sk_buff *skb, unsigned int addr_t 
	struct rtable *rt;

	struct flowi4 fl4 = {};

	__be32 saddr = iph->saddr;

	__u8 flags = skb->sk ? inet_sk_flowi_flags(skb->sk) : 0;

	const struct sock *sk = skb_to_full_sk(skb);

	__u8 flags = sk ? inet_sk_flowi_flags(sk) : 0;

	struct net_device *dev = skb_dst(skb)->dev;

	unsigned int hh_len;
@@ -40,7 +41,7 @@ int ip_route_me_harder(struct net *net, struct sk_buff *skb, unsigned int addr_t 
	fl4.daddr = iph->daddr;

	fl4.saddr = saddr;

	fl4.flowi4_tos = RT_TOS(iph->tos);

	fl4.flowi4_oif = skb->sk ? skb->sk->sk_bound_dev_if : 0;

	fl4.flowi4_oif = sk ? sk->sk_bound_dev_if : 0;

	if (!fl4.flowi4_oif)

		fl4.flowi4_oif = l3mdev_master_ifindex(dev);

	fl4.flowi4_mark = skb->mark;
@@ -61,7 +62,7 @@ int ip_route_me_harder(struct net *net, struct sk_buff *skb, unsigned int addr_t 
	    xfrm_decode_session(skb, flowi4_to_flowi(&fl4), AF_INET) == 0) {

		struct dst_entry *dst = skb_dst(skb);

		skb_dst_set(skb, NULL);

		dst = xfrm_lookup(net, dst, flowi4_to_flowi(&fl4), skb->sk, 0);

		dst = xfrm_lookup(net, dst, flowi4_to_flowi(&fl4), sk, 0);

		if (IS_ERR(dst))

			return PTR_ERR(dst);

		skb_dst_set(skb, dst);