Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1cd87883 authored by Lorenzo Bianconi's avatar Lorenzo Bianconi Committed by Greg Kroah-Hartman
Browse files

net: fou: do not use guehdr after iptunnel_pull_offloads in gue_udp_recv 



[ Upstream commit 988dc4a9a3b66be75b30405a5494faf0dc7cffb6 ]

gue tunnels run iptunnel_pull_offloads on received skbs. This can
determine a possible use-after-free accessing guehdr pointer since
the packet will be 'uncloned' running pskb_expand_head if it is a
cloned gso skb (e.g if the packet has been sent though a veth device)

Fixes: a09a4c8d ("tunnels: Remove encapsulation offloads on decap")
Signed-off-by: default avatarLorenzo Bianconi <lorenzo.bianconi@redhat.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 28045987

net/ipv4/fou.c

+3 −1
Original line number Diff line number Diff line
@@ -120,6 +120,7 @@ static int gue_udp_recv(struct sock *sk, struct sk_buff *skb) 
	struct guehdr *guehdr;

	void *data;

	u16 doffset = 0;

	u8 proto_ctype;



	if (!fou)

		return 1;
@@ -211,13 +212,14 @@ static int gue_udp_recv(struct sock *sk, struct sk_buff *skb) 
	if (unlikely(guehdr->control))

		return gue_control_message(skb, guehdr);



	proto_ctype = guehdr->proto_ctype;

	__skb_pull(skb, sizeof(struct udphdr) + hdrlen);

	skb_reset_transport_header(skb);



	if (iptunnel_pull_offloads(skb))

		goto drop;



	return -guehdr->proto_ctype;

	return -proto_ctype;



drop:

	kfree_skb(skb);