Kernel/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2025-01-04 04:06:26 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

xfrm Fix use after free in __xfrm6_udp_encap_rcv.

Browse Source 
A recent patch changed xfrm6_udp_encap_rcv to not
free the skb itself anymore but fogot the case
where xfrm4_udp_encap_rcv is called subsequently.

Fix this by moving the call to xfrm4_udp_encap_rcv
from __xfrm6_udp_encap_rcv to xfrm6_udp_encap_rcv.

Fixes: 221ddb723d ("xfrm: Support GRO for IPv6 ESP in UDP encapsulation")
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
This commit is contained in:
Steffen Klassert 2023-10-20 10:05:55 +02:00
parent efedce336d
commit 53a5b4f2ea
2 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
net/ipv4/xfrm4_input.c
View File

@ -159,7 +159,6 @@ static int __xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb, bool pull
/* process ESP */ /* process ESP */
return 0; return 0;
} }
EXPORT_SYMBOL(xfrm4_udp_encap_rcv);
/* If it's a keepalive packet, then just eat it. /* If it's a keepalive packet, then just eat it.
* If it's an encapsulated packet, then pass it to the * If it's an encapsulated packet, then pass it to the
@ -184,6 +183,7 @@ int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb)
return ret; return ret;
} }
EXPORT_SYMBOL(xfrm4_udp_encap_rcv);
struct sk_buff *xfrm4_gro_udp_encap_rcv(struct sock *sk, struct list_head *head, struct sk_buff *xfrm4_gro_udp_encap_rcv(struct sock *sk, struct list_head *head,
struct sk_buff *skb) struct sk_buff *skb)
@ -223,6 +223,7 @@ struct sk_buff *xfrm4_gro_udp_encap_rcv(struct sock *sk, struct list_head *head,
return NULL; return NULL;
} }
EXPORT_SYMBOL(xfrm4_gro_udp_encap_rcv);
int xfrm4_rcv(struct sk_buff *skb) int xfrm4_rcv(struct sk_buff *skb)
{ {

9
net/ipv6/xfrm6_input.c
View File

@ -80,9 +80,6 @@ static int __xfrm6_udp_encap_rcv(struct sock *sk, struct sk_buff *skb, bool pull
__be32 *udpdata32; __be32 *udpdata32;
u16 encap_type; u16 encap_type;
if (skb->protocol == htons(ETH_P_IP))
return xfrm4_udp_encap_rcv(sk, skb);
encap_type = READ_ONCE(up->encap_type); encap_type = READ_ONCE(up->encap_type);
/* if this is not encapsulated socket, then just return now */ /* if this is not encapsulated socket, then just return now */
if (!encap_type) if (!encap_type)
@ -169,6 +166,9 @@ int xfrm6_udp_encap_rcv(struct sock *sk, struct sk_buff *skb)
{ {
int ret; int ret;
if (skb->protocol == htons(ETH_P_IP))
return xfrm4_udp_encap_rcv(sk, skb);
ret = __xfrm6_udp_encap_rcv(sk, skb, true); ret = __xfrm6_udp_encap_rcv(sk, skb, true);
if (!ret) if (!ret)
return xfrm6_rcv_encap(skb, IPPROTO_ESP, 0, return xfrm6_rcv_encap(skb, IPPROTO_ESP, 0,
@ -190,6 +190,9 @@ struct sk_buff *xfrm6_gro_udp_encap_rcv(struct sock *sk, struct list_head *head,
struct sk_buff *pp = NULL; struct sk_buff *pp = NULL;
int ret; int ret;
if (skb->protocol == htons(ETH_P_IP))
return xfrm4_gro_udp_encap_rcv(sk, head, skb);
offset = offset - sizeof(struct udphdr); offset = offset - sizeof(struct udphdr);
if (!pskb_pull(skb, offset)) if (!pskb_pull(skb, offset))