summaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorTejaswi Tanikella <tejaswit@codeaurora.org>2017-10-23 08:16:03 +0200
committerPablo Neira Ayuso <pablo@netfilter.org>2017-11-01 12:15:29 +0100
commit7400bb4b5800831581a82f71700af6a5e815c3c8 (patch)
treeaabbc224b7f7d620573fd638431a26f0442eac59 /net
parentnetfilter: nft_set_hash: disable fast_ops for 2-len keys (diff)
downloadlinux-7400bb4b5800831581a82f71700af6a5e815c3c8.tar.xz
linux-7400bb4b5800831581a82f71700af6a5e815c3c8.zip
netfilter: nf_reject_ipv4: Fix use-after-free in send_reset
niph is not updated after pskb_expand_head changes the skb head. It still points to the freed data, which is then used to update tot_len and checksum. This could cause use-after-free poison crash. Update niph, if ip_route_me_harder does not fail. This only affects the interaction with REJECT targets and br_netfilter. Signed-off-by: Tejaswi Tanikella <tejaswit@codeaurora.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net')
-rw-r--r--net/ipv4/netfilter/nf_reject_ipv4.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/net/ipv4/netfilter/nf_reject_ipv4.c b/net/ipv4/netfilter/nf_reject_ipv4.c
index eeacbdaf7cdf..5cd06ba3535d 100644
--- a/net/ipv4/netfilter/nf_reject_ipv4.c
+++ b/net/ipv4/netfilter/nf_reject_ipv4.c
@@ -132,6 +132,8 @@ void nf_send_reset(struct net *net, struct sk_buff *oldskb, int hook)
if (ip_route_me_harder(net, nskb, RTN_UNSPEC))
goto free_nskb;
+ niph = ip_hdr(nskb);
+
/* "Never happens" */
if (nskb->len > dst_mtu(skb_dst(nskb)))
goto free_nskb;