leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

netfilter: fix use-after-free in NF_HOOK_LIST

Browse Source 
nf_hook() can free the skb, so we need to remove it from the list before
 calling, and add passed skbs to a sublist afterwards.

Fixes: 17266ee939 ("net: ipv4: listified version of ip_rcv")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Edward Cree <ecree@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Edward Cree 2018-07-09 18:10:02 +01:00 committed by David S. Miller
parent 8c057efaeb
commit 9f17dbf04d
1 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
include/linux/netfilter.h
View File

@ -294,12 +294,16 @@ NF_HOOK_LIST(uint8_t pf, unsigned int hook, struct net *net, struct sock *sk,
int (*okfn)(struct net *, struct sock *, struct sk_buff *)) int (*okfn)(struct net *, struct sock *, struct sk_buff *))
{ {
struct sk_buff *skb, *next; struct sk_buff *skb, *next;
struct list_head sublist;
INIT_LIST_HEAD(&sublist);
list_for_each_entry_safe(skb, next, head, list) { list_for_each_entry_safe(skb, next, head, list) {
int ret = nf_hook(pf, hook, net, sk, skb, in, out, okfn); list_del(&skb->list);
if (ret != 1) if (nf_hook(pf, hook, net, sk, skb, in, out, okfn) == 1)
list_del(&skb->list); list_add_tail(&skb->list, &sublist);
} }
/* Put passed packets back on main list */
list_splice(&sublist, head);
} }
/* Call setsockopt() */ /* Call setsockopt() */