Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 648f0c28 authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller
Browse files

net/dccp: fix use-after-free in dccp_invalid_packet 



pskb_may_pull() can reallocate skb->head, we need to reload dh pointer
in dccp_invalid_packet() or risk use after free.

Bug found by Andrey Konovalov using syzkaller.

Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Reported-by: default avatarAndrey Konovalov <andreyknvl@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent ffac0e96

net/dccp/ipv4.c

+7 −5
Original line number Diff line number Diff line
@@ -700,6 +700,7 @@ int dccp_invalid_packet(struct sk_buff *skb) 
{

	const struct dccp_hdr *dh;

	unsigned int cscov;

	u8 dccph_doff;



	if (skb->pkt_type != PACKET_HOST)

		return 1;
@@ -721,18 +722,19 @@ int dccp_invalid_packet(struct sk_buff *skb) 
	/*

	 * If P.Data Offset is too small for packet type, drop packet and return

	 */

	if (dh->dccph_doff < dccp_hdr_len(skb) / sizeof(u32)) {

		DCCP_WARN("P.Data Offset(%u) too small\n", dh->dccph_doff);

	dccph_doff = dh->dccph_doff;

	if (dccph_doff < dccp_hdr_len(skb) / sizeof(u32)) {

		DCCP_WARN("P.Data Offset(%u) too small\n", dccph_doff);

		return 1;

	}

	/*

	 * If P.Data Offset is too too large for packet, drop packet and return

	 */

	if (!pskb_may_pull(skb, dh->dccph_doff * sizeof(u32))) {

		DCCP_WARN("P.Data Offset(%u) too large\n", dh->dccph_doff);

	if (!pskb_may_pull(skb, dccph_doff * sizeof(u32))) {

		DCCP_WARN("P.Data Offset(%u) too large\n", dccph_doff);

		return 1;

	}



	dh = dccp_hdr(skb);

	/*

	 * If P.type is not Data, Ack, or DataAck and P.X == 0 (the packet

	 * has short sequence numbers), drop packet and return