Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d34c3044 authored by Zhengchao Shao's avatar Zhengchao Shao Committed by Greg Kroah-Hartman
Browse files

ip_vti: fix potential slab-use-after-free in decode_session6 



[ Upstream commit 6018a266279b1a75143c7c0804dd08a5fc4c3e0b ]

When ip_vti device is set to the qdisc of the sfb type, the cb field
of the sent skb may be modified during enqueuing. Then,
slab-use-after-free may occur when ip_vti device sends IPv6 packets.
As commit f8556919 ("xfrm6: Fix the nexthdr offset in
_decode_session6.") showed, xfrm_decode_session was originally intended
only for the receive path. IP6CB(skb)->nhoff is not set during
transmission. Therefore, set the cb field in the skb to 0 before
sending packets.

Fixes: f8556919 ("xfrm6: Fix the nexthdr offset in _decode_session6.")
Signed-off-by: default avatarZhengchao Shao <shaozhengchao@huawei.com>
Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent eb47e612

net/ipv4/ip_vti.c

+2 −2
Original line number Diff line number Diff line
@@ -314,12 +314,12 @@ static netdev_tx_t vti_tunnel_xmit(struct sk_buff *skb, struct net_device *dev) 


	switch (skb->protocol) {

	case htons(ETH_P_IP):

		xfrm_decode_session(skb, &fl, AF_INET);

		memset(IPCB(skb), 0, sizeof(*IPCB(skb)));

		xfrm_decode_session(skb, &fl, AF_INET);

		break;

	case htons(ETH_P_IPV6):

		xfrm_decode_session(skb, &fl, AF_INET6);

		memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));

		xfrm_decode_session(skb, &fl, AF_INET6);

		break;

	default:

		goto tx_err;