Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 64199fc0 authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller
Browse files

ipv4: fix use-after-free in ip_cmsg_recv_dstaddr() 



Caching ip_hdr(skb) before a call to pskb_may_pull() is buggy,
do not do it.

Fixes: 2efd4fca ("ip: in cmsg IP(V6)_ORIGDSTADDR call pskb_may_pull")
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Cc: Willem de Bruijn <willemb@google.com>
Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
Acked-by: default avatarWillem de Bruijn <willemb@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent b9f1bcb2

net/ipv4/ip_sockglue.c

+1 −2
Original line number Diff line number Diff line
@@ -149,7 +149,6 @@ static void ip_cmsg_recv_security(struct msghdr *msg, struct sk_buff *skb) 
static void ip_cmsg_recv_dstaddr(struct msghdr *msg, struct sk_buff *skb)

{

	struct sockaddr_in sin;

	const struct iphdr *iph = ip_hdr(skb);

	__be16 *ports;

	int end;
@@ -164,7 +163,7 @@ static void ip_cmsg_recv_dstaddr(struct msghdr *msg, struct sk_buff *skb) 
	ports = (__be16 *)skb_transport_header(skb);



	sin.sin_family = AF_INET;

	sin.sin_addr.s_addr = iph->daddr;

	sin.sin_addr.s_addr = ip_hdr(skb)->daddr;

	sin.sin_port = ports[1];

	memset(sin.sin_zero, 0, sizeof(sin.sin_zero));