Commit e11924b7 authored May 05, 2021 by Pablo Neira Ayuso Committed by Greg Kroah-Hartman May 22, 2021

netfilter: nfnetlink_osf: Fix a missing skb_header_pointer() NULL check



[ Upstream commit 5e024c325406470d1165a09c6feaf8ec897936be ]

Do not assume that the tcph->doff field is correct when parsing for TCP
options, skb_header_pointer() might fail to fetch these bits.

Fixes: 11eeef41 ("netfilter: passive OS fingerprint xtables match")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

parent bb101fb4

net/netfilter/nfnetlink_osf.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -191,6 +191,8 @@ static const struct tcphdr nf_osf_hdr_ctx_init(struct nf_osf_hdr_ctx ctx,

		ctx->optp = skb_header_pointer(skb, ip_hdrlen(skb) +
		sizeof(struct tcphdr), ctx->optsize, opts);
		if (!ctx->optp)
		return NULL;
		}

		return tcp;