Patch "ipv4: fix null-deref in ipv4_link_failure" has been added to the 4.19-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    ipv4: fix null-deref in ipv4_link_failure

to the 4.19-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     ipv4-fix-null-deref-in-ipv4_link_failure.patch
and it can be found in the queue-4.19 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit b6bff7bfc242b172f9d92c5ff41729afe2a7e73b
Author: Kyle Zeng <zengyhkyle@xxxxxxxxx>
Date:   Thu Sep 14 22:12:57 2023 -0700

    ipv4: fix null-deref in ipv4_link_failure
    
    [ Upstream commit 0113d9c9d1ccc07f5a3710dac4aa24b6d711278c ]
    
    Currently, we assume the skb is associated with a device before calling
    __ip_options_compile, which is not always the case if it is re-routed by
    ipvs.
    When skb->dev is NULL, dev_net(skb->dev) will become null-dereference.
    This patch adds a check for the edge case and switch to use the net_device
    from the rtable when skb->dev is NULL.
    
    Fixes: ed0de45a1008 ("ipv4: recompile ip options in ipv4_link_failure")
    Suggested-by: David Ahern <dsahern@xxxxxxxxxx>
    Signed-off-by: Kyle Zeng <zengyhkyle@xxxxxxxxx>
    Cc: Stephen Suryaputra <ssuryaextr@xxxxxxxxx>
    Cc: Vadim Fedorenko <vfedorenko@xxxxxxxx>
    Reviewed-by: David Ahern <dsahern@xxxxxxxxxx>
    Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 57e2316529d00..9753d07bfc0bf 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1215,6 +1215,7 @@ static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie)
 
 static void ipv4_send_dest_unreach(struct sk_buff *skb)
 {
+	struct net_device *dev;
 	struct ip_options opt;
 	int res;
 
@@ -1232,7 +1233,8 @@ static void ipv4_send_dest_unreach(struct sk_buff *skb)
 		opt.optlen = ip_hdr(skb)->ihl * 4 - sizeof(struct iphdr);
 
 		rcu_read_lock();
-		res = __ip_options_compile(dev_net(skb->dev), &opt, skb, NULL);
+		dev = skb->dev ? skb->dev : skb_rtable(skb)->dst.dev;
+		res = __ip_options_compile(dev_net(dev), &opt, skb, NULL);
 		rcu_read_unlock();
 
 		if (res)



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux