This is a note to let you know that I've just added the patch titled
net/dccp: fix use-after-free in dccp_invalid_packet
to the 4.8-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
net-dccp-fix-use-after-free-in-dccp_invalid_packet.patch
and it can be found in the queue-4.8 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From foo@baz Thu Dec 8 07:19:12 CET 2016
From: Eric Dumazet <edumazet@xxxxxxxxxx>
Date: Mon, 28 Nov 2016 06:26:49 -0800
Subject: net/dccp: fix use-after-free in dccp_invalid_packet
From: Eric Dumazet <edumazet@xxxxxxxxxx>
[ Upstream commit 648f0c28df282636c0c8a7a19ca3ce5fc80a39c3 ]
pskb_may_pull() can reallocate skb->head, we need to reload dh pointer
in dccp_invalid_packet() or risk use after free.
Bug found by Andrey Konovalov using syzkaller.
Signed-off-by: Eric Dumazet <edumazet@xxxxxxxxxx>
Reported-by: Andrey Konovalov <andreyknvl@xxxxxxxxxx>
Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
net/dccp/ipv4.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -700,6 +700,7 @@ int dccp_invalid_packet(struct sk_buff *
{
const struct dccp_hdr *dh;
unsigned int cscov;
+ u8 dccph_doff;
if (skb->pkt_type != PACKET_HOST)
return 1;
@@ -721,18 +722,19 @@ int dccp_invalid_packet(struct sk_buff *
/*
* If P.Data Offset is too small for packet type, drop packet and return
*/
- if (dh->dccph_doff < dccp_hdr_len(skb) / sizeof(u32)) {
- DCCP_WARN("P.Data Offset(%u) too small\n", dh->dccph_doff);
+ dccph_doff = dh->dccph_doff;
+ if (dccph_doff < dccp_hdr_len(skb) / sizeof(u32)) {
+ DCCP_WARN("P.Data Offset(%u) too small\n", dccph_doff);
return 1;
}
/*
* If P.Data Offset is too too large for packet, drop packet and return
*/
- if (!pskb_may_pull(skb, dh->dccph_doff * sizeof(u32))) {
- DCCP_WARN("P.Data Offset(%u) too large\n", dh->dccph_doff);
+ if (!pskb_may_pull(skb, dccph_doff * sizeof(u32))) {
+ DCCP_WARN("P.Data Offset(%u) too large\n", dccph_doff);
return 1;
}
-
+ dh = dccp_hdr(skb);
/*
* If P.type is not Data, Ack, or DataAck and P.X == 0 (the packet
* has short sequence numbers), drop packet and return
Patches currently in stable-queue which might be from edumazet@xxxxxxxxxx are
queue-4.8/ipv4-fix-memory-leak-in-exception-case-for-splitting-tries.patch
queue-4.8/virtio-net-add-a-missing-synchronize_net.patch
queue-4.8/gro_cells-mark-napi-struct-as-not-busy-poll-candidates.patch
queue-4.8/udplite-call-proper-backlog-handlers.patch
queue-4.8/ip6_offload-check-segs-for-null-in-ipv6_gso_segment.patch
queue-4.8/ipv4-restore-fib_trie_flush_external-function-and-fix-call-ordering.patch
queue-4.8/net-dccp-fix-use-after-free-in-dccp_invalid_packet.patch
queue-4.8/net-avoid-signed-overflows-for-so_-snd-rcv-bufforce.patch
queue-4.8/packet-fix-race-condition-in-packet_set_ring.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html