Commit 3a1c7565 authored Sep 03, 2013 by Daniel Borkmann Committed by David S. Miller Sep 04, 2013

net: ipv6: tcp: fix potential use after free in tcp_v6_do_rcv



In tcp_v6_do_rcv() code, when processing pkt options, we soley work
on our skb clone opt_skb that we've created earlier before entering
tcp_rcv_established() on our way. However, only in condition ...

  if (np->rxopt.bits.rxtclass)
    np->rcv_tclass = ipv6_get_dsfield(ipv6_hdr(skb));

... we work on skb itself. As we extract every other information out
of opt_skb in ipv6_pktoptions path, this seems wrong, since skb can
already be released by tcp_rcv_established() earlier on. When we try
to access it in ipv6_hdr(), we will dereference freed skb.

[ Bug added by commit 4c507d28 ("net: implement IP_RECVTOS for
  IP_PKTOPTIONS") ]

Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Acked-by: Jiri Benc <jbenc@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 25a6e6b8

net/ipv6/tcp_ipv6.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -1427,7 +1427,7 @@ ipv6_pktoptions:
		if (np->rxopt.bits.rxhlim \|\| np->rxopt.bits.rxohlim)
		np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
		if (np->rxopt.bits.rxtclass)
		np->rcv_tclass = ipv6_get_dsfield(ipv6_hdr(skb));
		np->rcv_tclass = ipv6_get_dsfield(ipv6_hdr(opt_skb));
		if (ipv6_opt_accepted(sk, opt_skb)) {
		skb_set_owner_r(opt_skb, sk);
		opt_skb = xchg(&np->pktoptions, opt_skb);

Admin message