Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9f17dbf0 authored by Edward Cree's avatar Edward Cree Committed by David S. Miller
Browse files

netfilter: fix use-after-free in NF_HOOK_LIST 



nf_hook() can free the skb, so we need to remove it from the list before
 calling, and add passed skbs to a sublist afterwards.

Fixes: 17266ee9 ("net: ipv4: listified version of ip_rcv")
Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarEdward Cree <ecree@solarflare.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 8c057efa

include/linux/netfilter.h

+7 −3
Original line number Diff line number Diff line
@@ -294,12 +294,16 @@ NF_HOOK_LIST(uint8_t pf, unsigned int hook, struct net *net, struct sock *sk, 
	     int (*okfn)(struct net *, struct sock *, struct sk_buff *))

{

	struct sk_buff *skb, *next;

	struct list_head sublist;



	INIT_LIST_HEAD(&sublist);

	list_for_each_entry_safe(skb, next, head, list) {

		int ret = nf_hook(pf, hook, net, sk, skb, in, out, okfn);

		if (ret != 1)

		list_del(&skb->list);

		if (nf_hook(pf, hook, net, sk, skb, in, out, okfn) == 1)

			list_add_tail(&skb->list, &sublist);

	}

	/* Put passed packets back on main list */

	list_splice(&sublist, head);

}



/* Call setsockopt() */