brain-hackers_pepepper-mirror
/
linux-brain
mirror of https://github.com/brain-hackers/linux-brain.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
linux-brain/net/ipv6
History
Benjamin Hesmans d448b240b1 netfilter: socket: icmp6: fix use-after-scope 
[ Upstream commit 730affed24bffcd1eebd5903171960f5ff9f1f22 ]

Bug reported by KASAN:

BUG: KASAN: use-after-scope in inet6_ehashfn (net/ipv6/inet6_hashtables.c:40)
Call Trace:
(...)
inet6_ehashfn (net/ipv6/inet6_hashtables.c:40)
(...)
nf_sk_lookup_slow_v6 (net/ipv6/netfilter/nf_socket_ipv6.c:91
net/ipv6/netfilter/nf_socket_ipv6.c:146)

It seems that this bug has already been fixed by Eric Dumazet in the
past in:
commit 78296c97ca ("netfilter: xt_socket: fix a stack corruption bug")

But a variant of the same issue has been introduced in
commit d64d80a2cd ("netfilter: x_tables: don't extract flow keys on early demuxed sks in socket match")

`daddr` and `saddr` potentially hold a reference to ipv6_var that is no
longer in scope when the call to `nf_socket_get_sock_v6` is made.

Fixes: d64d80a2cd ("netfilter: x_tables: don't extract flow keys on early demuxed sks in socket match")
Acked-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: Benjamin Hesmans <benjamin.hesmans@tessares.net>
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 		2021-09-22 12:26:45 +02:00
..
ila treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
netfilter netfilter: socket: icmp6: fix use-after-scope 2021-09-22 12:26:45 +02:00
Kconfig net: ipv6: fix kconfig dependency warning for IPV6_SEG6_HMAC 2020-09-26 18:03:13 +02:00
Makefile xfrm: make xfrm modes builtin 2019-04-08 09:15:17 +02:00
addrconf.c net: ipv4: Remove unneed BUG() function 2021-06-30 08:47:46 -04:00
addrconf_core.c net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup 2019-12-18 16:08:42 +01:00
addrlabel.c ipv6: addrlabel: fix possible memory leak in ip6addrlbl_net_init 2020-12-08 10:40:23 +01:00
af_inet6.c net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup 2019-12-18 16:08:42 +01:00
ah6.c ah6: fix error return code in ah6_input() 2020-11-24 13:28:55 +01:00
anycast.c ipv6: fix memory leaks on IPV6_ADDRFORM path 2020-08-11 15:33:39 +02:00
calipso.c cipso,calipso: resolve a number of problems with the DOI refcounts 2021-03-17 17:03:35 +01:00
datagram.c net: ipv6: add net argument to ip6_dst_lookup_flow 2019-12-18 16:08:40 +01:00
esp6.c xfrm: xfrm_state_mtu should return at least 1280 for ipv6 2021-07-14 16:53:26 +02:00
esp6_offload.c esp: delete NETIF_F_SCTP_CRC bit from features for esp offload 2021-04-14 08:24:13 +02:00
exthdrs.c ipv6: fix out-of-bound access in ip6_parse_tlv() 2021-07-14 16:53:33 +02:00
exthdrs_core.c ipv6: remove printk 2019-07-27 14:23:48 -07:00
exthdrs_offload.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
fib6_notifier.c net: Add module reference to FIB notifiers 2017-09-01 20:33:42 -07:00
fib6_rules.c ipv6: do not free rt if FIB_LOOKUP_NOREF is set on suppress rule 2019-09-26 09:34:25 +02:00
fou6.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
icmp.c net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending 2021-03-04 10:26:53 +01:00
inet6_connection_sock.c net: add bool confirm_neigh parameter for dst_ops.update_pmtu 2020-01-04 19:18:58 +01:00
inet6_hashtables.c net: annotate accesses to sk->sk_incoming_cpu 2019-10-30 13:24:25 -07:00
ip6_checksum.c net: udp: fix handling of CHECKSUM_COMPLETE packets 2018-10-24 14:18:16 -07:00
ip6_fib.c ipv6: fix suspecious RCU usage warning 2021-03-30 14:35:25 +02:00
ip6_flowlabel.c ipv6: fix static key imbalance in fl_create() 2019-07-11 14:43:25 -07:00
ip6_gre.c ipv6: remove extra dev_hold() for fallback tunnels 2021-05-22 11:38:30 +02:00
ip6_icmp.c net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending 2021-03-04 10:26:53 +01:00
ip6_input.c ipv6: weaken the v4mapped source check 2021-04-07 14:47:38 +02:00
ip6_offload.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
ip6_offload.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
ip6_output.c ipv6: ip6_finish_output2: set sk into newly allocated nskb 2021-07-31 08:19:39 +02:00
ip6_tunnel.c ipv6: remove extra dev_hold() for fallback tunnels 2021-05-22 11:38:30 +02:00
ip6_udp_tunnel.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
ip6_vti.c ipv6: remove extra dev_hold() for fallback tunnels 2021-05-22 11:38:30 +02:00
ip6mr.c net: don't return invalid table id error when we fall back to PF_UNSPEC 2020-06-03 08:20:41 +02:00
ipcomp6.c xfrm: remove type and offload_type map from xfrm_state_afinfo 2019-06-06 08:34:50 +02:00
ipv6_sockglue.c ipv6: fix memory leaks on IPV6_ADDRFORM path 2020-08-11 15:33:39 +02:00
mcast.c mld: fix panic in mld_newpack() 2021-06-03 08:59:14 +02:00
mcast_snoop.c net: bridge: mcast: fix broken length + header check for MRDv6 Adv. 2021-05-14 09:44:32 +02:00
mip6.c xfrm: remove type and offload_type map from xfrm_state_afinfo 2019-06-06 08:34:50 +02:00
ndisc.c Exempt multicast addresses from five-second neighbor lifetime 2020-11-24 13:28:56 +01:00
netfilter.c netfilter: use actual socket sk rather than skb sk when routing harder 2020-11-18 19:20:17 +01:00
output_core.c ipv6: use prandom_u32() for ID generation 2021-07-19 08:53:09 +02:00
ping.c ipv6: Fix the link time qualifier of 'ping_v6_proc_exit_net()' 2019-09-12 11:20:33 +01:00
proc.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2019-06-07 11:00:14 -07:00
protocol.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
raw.c net-ipv6: bugfix - raw & sctp - switch to ipv6_can_nonlocal_bind() 2021-04-14 08:24:12 +02:00
reassembly.c ipv6: record frag_max_size in atomic fragments in input path 2021-06-03 08:59:15 +02:00
route.c ipv6: make exception cache less predictible 2021-09-15 09:47:37 +02:00
seg6.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
seg6_hmac.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
seg6_iptunnel.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
seg6_local.c ipv6: sr: remove SKB_GSO_IPXIP6 on End.D* actions 2020-01-29 16:45:20 +01:00
sit.c ipv6: remove extra dev_hold() for fallback tunnels 2021-05-22 11:38:30 +02:00
syncookies.c net: Update window_clamp if SOCK_RCVBUF is set 2020-11-18 19:20:32 +01:00
sysctl_net_ipv6.c ipv6: Fix sysctl max for fib_multipath_hash_policy 2020-09-12 14:18:55 +02:00
tcp_ipv6.c ipv6: tcp: drop silly ICMPv6 packet too big messages 2021-07-25 14:35:15 +02:00
tcpv6_offload.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
tunnel6.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13 2019-05-21 11:28:45 +02:00
udp.c udp: annotate data races around unix_sk(sk)->gso_size 2021-07-25 14:35:15 +02:00
udp_impl.h udp6: add missing rehash callback to udplite 2019-01-17 15:01:08 -08:00
udp_offload.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
udplite.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
xfrm6_input.c net: use skb_sec_path helper in more places 2018-12-19 11:21:37 -08:00
xfrm6_output.c net: ipv6: fix return value of ip6_skb_dst_mtu 2021-07-25 14:35:14 +02:00
xfrm6_policy.c net: add bool confirm_neigh parameter for dst_ops.update_pmtu 2020-01-04 19:18:58 +01:00
xfrm6_protocol.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
xfrm6_state.c xfrm: remove eth_proto value from xfrm_state_afinfo 2019-06-06 08:34:50 +02:00
xfrm6_tunnel.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13 2019-05-21 11:28:45 +02:00