[PATCH 5.15 046/171] netfilter: nft_exthdr: break evaluation if setting TCP option fails

Greg Kroah-Hartman
2021-12-13T10:19:16Z

From: Pablo Neira Ayuso <pablo@netfilter.org>

commit 962e5a40358787105f126ab1dc01604da3d169e9 upstream.

Break rule evaluation on malformed TCP options.

Fixes: 99d1712bc41c ("netfilter: exthdr: tcp option set support")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nft_exthdr.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)

--- a/net/netfilter/nft_exthdr.c
+++ b/net/netfilter/nft_exthdr.c
@@ -236,7 +236,7 @@ static void nft_exthdr_tcp_set_eval(cons

tcph = nft_tcp_header_pointer(pkt, sizeof(buff), buff, &tcphdr_len);
if (!tcph)
- return;
+ goto err;

opt = (u8 *)tcph;
for (i = sizeof(*tcph); i < tcphdr_len - 1; i += optl) {
@@ -251,16 +251,16 @@ static void nft_exthdr_tcp_set_eval(cons
continue;

if (i + optl > tcphdr_len || priv->len + priv->offset > optl)
- return;
+ goto err;

if (skb_ensure_writable(pkt->skb,
nft_thoff(pkt) + i + priv->len))
- return;
+ goto err;

tcph = nft_tcp_header_pointer(pkt, sizeof(buff), buff,
&tcphdr_len);
if (!tcph)
- return;
+ goto err;

offset = i + priv->offset;

@@ -303,6 +303,9 @@ static void nft_exthdr_tcp_set_eval(cons

return;
}
+ return;
+err:
+ regs->verdict.code = NFT_BREAK;
}

static void nft_exthdr_sctp_eval(const struct nft_expr *expr,