iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'erspan-use-after-free'

Browse Source 
Lorenzo Bianconi says:

====================
fix possible use-after-free in erspan_v{4,6}

Similar to what I did in commit bb9bd814eb ("ipv6: sit: reset ip
header pointer in ipip6_rcv"), fix possible use-after-free in
erspan_rcv and ip6erspan_rcv extracting tunnel metadata since the
packet can be 'uncloned' running __iptunnel_pull_header
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
David S. Miller 2019-04-08 16:16:47 -07:00
commit 3c5189ad70
2 changed files with 23 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
net/ipv4/ip_gre.c
View File

@ -259,7 +259,6 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi,
struct net *net = dev_net(skb->dev); struct net *net = dev_net(skb->dev);
struct metadata_dst *tun_dst = NULL; struct metadata_dst *tun_dst = NULL;
struct erspan_base_hdr *ershdr; struct erspan_base_hdr *ershdr;
struct erspan_metadata *pkt_md;
struct ip_tunnel_net *itn; struct ip_tunnel_net *itn;
struct ip_tunnel *tunnel; struct ip_tunnel *tunnel;
const struct iphdr *iph; const struct iphdr *iph;
@ -282,9 +281,6 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi,
if (unlikely(!pskb_may_pull(skb, len))) if (unlikely(!pskb_may_pull(skb, len)))
return PACKET_REJECT; return PACKET_REJECT;
ershdr = (struct erspan_base_hdr *)(skb->data + gre_hdr_len);
pkt_md = (struct erspan_metadata *)(ershdr + 1);
if (__iptunnel_pull_header(skb, if (__iptunnel_pull_header(skb,
len, len,
htons(ETH_P_TEB), htons(ETH_P_TEB),
@ -292,8 +288,9 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi,
goto drop; goto drop;
if (tunnel->collect_md) { if (tunnel->collect_md) {
struct erspan_metadata *pkt_md, *md;
struct ip_tunnel_info *info; struct ip_tunnel_info *info;
struct erspan_metadata *md; unsigned char *gh;
__be64 tun_id; __be64 tun_id;
__be16 flags; __be16 flags;
@ -306,6 +303,14 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi,
if (!tun_dst) if (!tun_dst)
return PACKET_REJECT; return PACKET_REJECT;
/* skb can be uncloned in __iptunnel_pull_header, so
* old pkt_md is no longer valid and we need to reset
* it
*/
gh = skb_network_header(skb) +
skb_network_header_len(skb);
pkt_md = (struct erspan_metadata *)(gh + gre_hdr_len +
sizeof(*ershdr));
md = ip_tunnel_info_opts(&tun_dst->u.tun_info); md = ip_tunnel_info_opts(&tun_dst->u.tun_info);
md->version = ver; md->version = ver;
md2 = &md->u.md2; md2 = &md->u.md2;

20
net/ipv6/ip6_gre.c
View File

@ -525,10 +525,10 @@ static int ip6gre_rcv(struct sk_buff *skb, const struct tnl_ptk_info *tpi)
} }
static int ip6erspan_rcv(struct sk_buff *skb, static int ip6erspan_rcv(struct sk_buff *skb,
struct tnl_ptk_info *tpi) struct tnl_ptk_info *tpi,
int gre_hdr_len)
{ {
struct erspan_base_hdr *ershdr; struct erspan_base_hdr *ershdr;
struct erspan_metadata *pkt_md;
const struct ipv6hdr *ipv6h; const struct ipv6hdr *ipv6h;
struct erspan_md2 *md2; struct erspan_md2 *md2;
struct ip6_tnl *tunnel; struct ip6_tnl *tunnel;
@ -547,18 +547,16 @@ static int ip6erspan_rcv(struct sk_buff *skb,
if (unlikely(!pskb_may_pull(skb, len))) if (unlikely(!pskb_may_pull(skb, len)))
return PACKET_REJECT; return PACKET_REJECT;
ershdr = (struct erspan_base_hdr *)skb->data;
pkt_md = (struct erspan_metadata *)(ershdr + 1);
if (__iptunnel_pull_header(skb, len, if (__iptunnel_pull_header(skb, len,
htons(ETH_P_TEB), htons(ETH_P_TEB),
false, false) < 0) false, false) < 0)
return PACKET_REJECT; return PACKET_REJECT;
if (tunnel->parms.collect_md) { if (tunnel->parms.collect_md) {
struct erspan_metadata *pkt_md, *md;
struct metadata_dst *tun_dst; struct metadata_dst *tun_dst;
struct ip_tunnel_info *info; struct ip_tunnel_info *info;
struct erspan_metadata *md; unsigned char *gh;
__be64 tun_id; __be64 tun_id;
__be16 flags; __be16 flags;
@ -571,6 +569,14 @@ static int ip6erspan_rcv(struct sk_buff *skb,
if (!tun_dst) if (!tun_dst)
return PACKET_REJECT; return PACKET_REJECT;
/* skb can be uncloned in __iptunnel_pull_header, so
* old pkt_md is no longer valid and we need to reset
* it
*/
gh = skb_network_header(skb) +
skb_network_header_len(skb);
pkt_md = (struct erspan_metadata *)(gh + gre_hdr_len +
sizeof(*ershdr));
info = &tun_dst->u.tun_info; info = &tun_dst->u.tun_info;
md = ip_tunnel_info_opts(info); md = ip_tunnel_info_opts(info);
md->version = ver; md->version = ver;
@ -607,7 +613,7 @@ static int gre_rcv(struct sk_buff *skb)
if (unlikely(tpi.proto == htons(ETH_P_ERSPAN) || if (unlikely(tpi.proto == htons(ETH_P_ERSPAN) ||
tpi.proto == htons(ETH_P_ERSPAN2))) { tpi.proto == htons(ETH_P_ERSPAN2))) {
if (ip6erspan_rcv(skb, &tpi) == PACKET_RCVD) if (ip6erspan_rcv(skb, &tpi, hdr_len) == PACKET_RCVD)
return 0; return 0;
goto out; goto out;
} }