Commit 988dc4a9 authored Apr 09, 2019 by Lorenzo Bianconi Committed by David S. Miller Apr 10, 2019

net: fou: do not use guehdr after iptunnel_pull_offloads in gue_udp_recv

gue tunnels run iptunnel_pull_offloads on received skbs. This can
determine a possible use-after-free accessing guehdr pointer since
the packet will be 'uncloned' running pskb_expand_head if it is a
cloned gso skb (e.g if the packet has been sent though a veth device)

Fixes: a09a4c8d ("tunnels: Remove encapsulation offloads on decap")
Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent d1841533

net/ipv4/fou.c

+3 −1

Original line number	Diff line number	Diff line
		@@ -121,6 +121,7 @@ static int gue_udp_recv(struct sock sk, struct sk_buff skb)
		struct guehdr *guehdr;
		void *data;
		u16 doffset = 0;
		u8 proto_ctype;

		if (!fou)
		return 1;
		@@ -212,13 +213,14 @@ static int gue_udp_recv(struct sock sk, struct sk_buff skb)
		if (unlikely(guehdr->control))
		return gue_control_message(skb, guehdr);

		proto_ctype = guehdr->proto_ctype;
		__skb_pull(skb, sizeof(struct udphdr) + hdrlen);
		skb_reset_transport_header(skb);

		if (iptunnel_pull_offloads(skb))
		goto drop;

		return -guehdr->proto_ctype;
		return -proto_ctype;

		drop:
		kfree_skb(skb);

Admin message