From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:57410 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750827AbcLHGUk (ORCPT ); Thu, 8 Dec 2016 01:20:40 -0500 Subject: Patch "net/dccp: fix use-after-free in dccp_invalid_packet" has been added to the 4.4-stable tree To: edumazet@google.com, andreyknvl@google.com, davem@davemloft.net, gregkh@linuxfoundation.org Cc: , From: Date: Thu, 08 Dec 2016 07:20:16 +0100 Message-ID: <14811780167012@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled net/dccp: fix use-after-free in dccp_invalid_packet to the 4.4-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: net-dccp-fix-use-after-free-in-dccp_invalid_packet.patch and it can be found in the queue-4.4 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From foo@baz Thu Dec 8 07:18:57 CET 2016 From: Eric Dumazet Date: Mon, 28 Nov 2016 06:26:49 -0800 Subject: net/dccp: fix use-after-free in dccp_invalid_packet From: Eric Dumazet [ Upstream commit 648f0c28df282636c0c8a7a19ca3ce5fc80a39c3 ] pskb_may_pull() can reallocate skb->head, we need to reload dh pointer in dccp_invalid_packet() or risk use after free. Bug found by Andrey Konovalov using syzkaller. Signed-off-by: Eric Dumazet Reported-by: Andrey Konovalov Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/dccp/ipv4.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) --- a/net/dccp/ipv4.c +++ b/net/dccp/ipv4.c @@ -698,6 +698,7 @@ int dccp_invalid_packet(struct sk_buff * { const struct dccp_hdr *dh; unsigned int cscov; + u8 dccph_doff; if (skb->pkt_type != PACKET_HOST) return 1; @@ -719,18 +720,19 @@ int dccp_invalid_packet(struct sk_buff * /* * If P.Data Offset is too small for packet type, drop packet and return */ - if (dh->dccph_doff < dccp_hdr_len(skb) / sizeof(u32)) { - DCCP_WARN("P.Data Offset(%u) too small\n", dh->dccph_doff); + dccph_doff = dh->dccph_doff; + if (dccph_doff < dccp_hdr_len(skb) / sizeof(u32)) { + DCCP_WARN("P.Data Offset(%u) too small\n", dccph_doff); return 1; } /* * If P.Data Offset is too too large for packet, drop packet and return */ - if (!pskb_may_pull(skb, dh->dccph_doff * sizeof(u32))) { - DCCP_WARN("P.Data Offset(%u) too large\n", dh->dccph_doff); + if (!pskb_may_pull(skb, dccph_doff * sizeof(u32))) { + DCCP_WARN("P.Data Offset(%u) too large\n", dccph_doff); return 1; } - + dh = dccp_hdr(skb); /* * If P.type is not Data, Ack, or DataAck and P.X == 0 (the packet * has short sequence numbers), drop packet and return Patches currently in stable-queue which might be from edumazet@google.com are queue-4.4/virtio-net-add-a-missing-synchronize_net.patch queue-4.4/net-dccp-fix-use-after-free-in-dccp_invalid_packet.patch queue-4.4/net-avoid-signed-overflows-for-so_-snd-rcv-bufforce.patch queue-4.4/packet-fix-race-condition-in-packet_set_ring.patch