diff options
| author | Florian Westphal <[email protected]> | 2017-11-01 19:30:49 +0000 |
|---|---|---|
| committer | Steffen Klassert <[email protected]> | 2017-11-02 10:53:53 +0000 |
| commit | cb79a180f2e7eb51de5a4848652893197637bccb (patch) | |
| tree | 0c10afe3f7be5f2228ac3fddabf4977d14cd6119 /net/sched/cls_basic.c | |
| parent | Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf (diff) | |
| download | kernel-cb79a180f2e7eb51de5a4848652893197637bccb.tar.gz kernel-cb79a180f2e7eb51de5a4848652893197637bccb.zip | |
xfrm: defer daddr pointer assignment after spi parsing
syzbot reports:
BUG: KASAN: use-after-free in __xfrm_state_lookup+0x695/0x6b0
Read of size 4 at addr ffff8801d434e538 by task syzkaller647520/2991
[..]
__xfrm_state_lookup+0x695/0x6b0 net/xfrm/xfrm_state.c:833
xfrm_state_lookup+0x8a/0x160 net/xfrm/xfrm_state.c:1592
xfrm_input+0x8e5/0x22f0 net/xfrm/xfrm_input.c:302
The use-after-free is the ipv4 destination address, which points
to an skb head area that has been reallocated:
pskb_expand_head+0x36b/0x1210 net/core/skbuff.c:1494
__pskb_pull_tail+0x14a/0x17c0 net/core/skbuff.c:1877
pskb_may_pull include/linux/skbuff.h:2102 [inline]
xfrm_parse_spi+0x3d3/0x4d0 net/xfrm/xfrm_input.c:170
xfrm_input+0xce2/0x22f0 net/xfrm/xfrm_input.c:291
so the real bug is that xfrm_parse_spi() uses pskb_may_pull, but
for now do smaller workaround that makes xfrm_input fetch daddr
after spi parsing.
Reported-by: syzbot <[email protected]>
Signed-off-by: Florian Westphal <[email protected]>
Signed-off-by: Steffen Klassert <[email protected]>
Diffstat (limited to 'net/sched/cls_basic.c')
0 files changed, 0 insertions, 0 deletions