Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 52be29e8 authored by Florian Westphal's avatar Florian Westphal Committed by Greg Kroah-Hartman
Browse files

netfilter: nf_queue: do not allow packet truncation below transport header offset 



[ Upstream commit 99a63d36cb3ed5ca3aa6fcb64cffbeaf3b0fb164 ]

Domingo Dirutigliano and Nicola Guerrera report kernel panic when
sending nf_queue verdict with 1-byte nfta_payload attribute.

The IP/IPv6 stack pulls the IP(v6) header from the packet after the
input hook.

If user truncates the packet below the header size, this skb_pull() will
result in a malformed skb (skb->len < 0).

Fixes: 7af4cc3f ("[NETFILTER]: Add "nfnetlink_queue" netfilter queue handler over nfnetlink")
Reported-by: default avatarDomingo Dirutigliano <pwnzer0tt1@proton.me>
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Reviewed-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 8e0ed463

net/netfilter/nfnetlink_queue.c

+6 −1
Original line number Diff line number Diff line
@@ -846,11 +846,16 @@ nfqnl_enqueue_packet(struct nf_queue_entry *entry, unsigned int queuenum) 
}



static int

nfqnl_mangle(void *data, int data_len, struct nf_queue_entry *e, int diff)

nfqnl_mangle(void *data, unsigned int data_len, struct nf_queue_entry *e, int diff)

{

	struct sk_buff *nskb;



	if (diff < 0) {

		unsigned int min_len = skb_transport_offset(e->skb);



		if (data_len < min_len)

			return -EINVAL;



		if (pskb_trim(e->skb, data_len))

			return -ENOMEM;

	} else if (diff > 0) {