Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a6d4518d authored by Li RongQing's avatar Li RongQing Committed by David S. Miller
Browse files

ipv6: fix a potential use after free in sit.c 



pskb_may_pull() maybe change skb->data and make iph pointer oboslete,
fix it by geting ip header length directly.

Fixes: ca15a078 (sit: generate icmpv6 error when receiving icmpv4 error)
Cc: Oussama Ghorbel <ghorbel@pivasoftware.com>
Signed-off-by: default avatarLi RongQing <roy.qing.li@gmail.com>
Acked-by: default avatarEric Dumazet <edumazet@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent fc6fb41c

net/ipv6/sit.c

+3 −3
Original line number Diff line number Diff line
@@ -485,11 +485,11 @@ static void ipip6_tunnel_uninit(struct net_device *dev) 
 */

static int ipip6_err_gen_icmpv6_unreach(struct sk_buff *skb)

{

	const struct iphdr *iph = (const struct iphdr *) skb->data;

	int ihl = ((const struct iphdr *)skb->data)->ihl*4;

	struct rt6_info *rt;

	struct sk_buff *skb2;



	if (!pskb_may_pull(skb, iph->ihl * 4 + sizeof(struct ipv6hdr) + 8))

	if (!pskb_may_pull(skb, ihl + sizeof(struct ipv6hdr) + 8))

		return 1;



	skb2 = skb_clone(skb, GFP_ATOMIC);
@@ -498,7 +498,7 @@ static int ipip6_err_gen_icmpv6_unreach(struct sk_buff *skb) 
		return 1;



	skb_dst_drop(skb2);

	skb_pull(skb2, iph->ihl * 4);

	skb_pull(skb2, ihl);

	skb_reset_network_header(skb2);



	rt = rt6_lookup(dev_net(skb->dev), &ipv6_hdr(skb2)->saddr, NULL, 0, 0);