net: ip_gre: fix possible use-after-free in erspan_rcv
erspan tunnels run __iptunnel_pull_header on received skbs to remove
gre and erspan headers. This can determine a possible use-after-free
accessing pkt_md pointer in erspan_rcv since the packet will be 'uncloned'
running pskb_expand_head if it is a cloned gso skb (e.g if the packet has
been sent though a veth device). Fix it resetting pkt_md pointer after
__iptunnel_pull_header
Fixes: 1d7e2ed22f
("net: erspan: refactor existing erspan code")
Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
b75bb8a5b7
commit
492b67e28e
@ -259,7 +259,6 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi,
|
|||||||
struct net *net = dev_net(skb->dev);
|
struct net *net = dev_net(skb->dev);
|
||||||
struct metadata_dst *tun_dst = NULL;
|
struct metadata_dst *tun_dst = NULL;
|
||||||
struct erspan_base_hdr *ershdr;
|
struct erspan_base_hdr *ershdr;
|
||||||
struct erspan_metadata *pkt_md;
|
|
||||||
struct ip_tunnel_net *itn;
|
struct ip_tunnel_net *itn;
|
||||||
struct ip_tunnel *tunnel;
|
struct ip_tunnel *tunnel;
|
||||||
const struct iphdr *iph;
|
const struct iphdr *iph;
|
||||||
@ -282,9 +281,6 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi,
|
|||||||
if (unlikely(!pskb_may_pull(skb, len)))
|
if (unlikely(!pskb_may_pull(skb, len)))
|
||||||
return PACKET_REJECT;
|
return PACKET_REJECT;
|
||||||
|
|
||||||
ershdr = (struct erspan_base_hdr *)(skb->data + gre_hdr_len);
|
|
||||||
pkt_md = (struct erspan_metadata *)(ershdr + 1);
|
|
||||||
|
|
||||||
if (__iptunnel_pull_header(skb,
|
if (__iptunnel_pull_header(skb,
|
||||||
len,
|
len,
|
||||||
htons(ETH_P_TEB),
|
htons(ETH_P_TEB),
|
||||||
@ -292,8 +288,9 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi,
|
|||||||
goto drop;
|
goto drop;
|
||||||
|
|
||||||
if (tunnel->collect_md) {
|
if (tunnel->collect_md) {
|
||||||
|
struct erspan_metadata *pkt_md, *md;
|
||||||
struct ip_tunnel_info *info;
|
struct ip_tunnel_info *info;
|
||||||
struct erspan_metadata *md;
|
unsigned char *gh;
|
||||||
__be64 tun_id;
|
__be64 tun_id;
|
||||||
__be16 flags;
|
__be16 flags;
|
||||||
|
|
||||||
@ -306,6 +303,14 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi,
|
|||||||
if (!tun_dst)
|
if (!tun_dst)
|
||||||
return PACKET_REJECT;
|
return PACKET_REJECT;
|
||||||
|
|
||||||
|
/* skb can be uncloned in __iptunnel_pull_header, so
|
||||||
|
* old pkt_md is no longer valid and we need to reset
|
||||||
|
* it
|
||||||
|
*/
|
||||||
|
gh = skb_network_header(skb) +
|
||||||
|
skb_network_header_len(skb);
|
||||||
|
pkt_md = (struct erspan_metadata *)(gh + gre_hdr_len +
|
||||||
|
sizeof(*ershdr));
|
||||||
md = ip_tunnel_info_opts(&tun_dst->u.tun_info);
|
md = ip_tunnel_info_opts(&tun_dst->u.tun_info);
|
||||||
md->version = ver;
|
md->version = ver;
|
||||||
md2 = &md->u.md2;
|
md2 = &md->u.md2;
|
||||||
|
Loading…
Reference in New Issue
Block a user