From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E97A840800E; Wed, 20 May 2026 18:43:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779302621; cv=none; b=KjuuSRJcxKc7qx4x3G36bV1F5b2Orbc6Ja86aqaXgShWCms8ED5bwTMy+yfTmkge3L9mJAq6Tn7jpyMZZ8gXSFvEW2vQbmtsQN1K+654c2klyzk5XqvfCBQq2DqA7MdZ0HJDwiUz8nGL+5bIbCTH1CeDtuKNijazCuaZ0JBOMDk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779302621; c=relaxed/simple; bh=ZIBf7aMk94p9lwKdiaEFi9sp01G0ogjMeF7a7+2JC2E=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=O/6dKgiJoTVQbsICeFY2/QO2PSXhoxXWMUhYf1/Jw/HhlR6JVcjN+5Y/FUF2kJSzZfT1IxMQuuD9H/Z4fGSEqt6a4SLzh18K4Ms9XQMCBJO9VKPQpGXRtd4ocQfBuiBGgUeAA5tBwbNn2Jw2HxG31WxoVMKYQ50teSOC7rqvRq4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=WX17cinB; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="WX17cinB" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5A4D11F000E9; Wed, 20 May 2026 18:43:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1779302619; bh=T1Rj+ATtah/wQiVsre1RQlbpeJxPNoXdvW/dohvNe3I=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=WX17cinBXYH0o5uVJmZsBiPKuercNYwvlFO6JOPwsGKVURke2l6D6gAvB5CwavNhd DG2C2ujwJ/ZgRBFkJyou4LitSuKHbMVUWPrPUdGTUXKTzs/ouTdE6uUVhYf7r/qRVf GlOtyH6S5pXUTWkO3eeCdhyOUwlO6PI7cX3ELq3k= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, "Kito Xu (veritas501)" , Fernando Fernandez Mancera , Pablo Neira Ayuso , Sasha Levin Subject: [PATCH 6.6 335/508] netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check Date: Wed, 20 May 2026 18:22:38 +0200 Message-ID: <20260520162105.891839966@linuxfoundation.org> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260520162058.573354582@linuxfoundation.org> References: <20260520162058.573354582@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Fernando Fernandez Mancera [ Upstream commit 711987ba281fd806322a7cd244e98e2a81903114 ] The nf_osf_ttl() function accessed skb->dev to perform a local interface address lookup without verifying that the device pointer was valid. Additionally, the implementation utilized an in_dev_for_each_ifa_rcu loop to match the packet source address against local interface addresses. It assumed that packets from the same subnet should not see a decrement on the initial TTL. A packet might appear it is from the same subnet but it actually isn't especially in modern environments with containers and virtual switching. Remove the device dereference and interface loop. Replace the logic with a switch statement that evaluates the TTL according to the ttl_check. Fixes: 11eeef41d5f6 ("netfilter: passive OS fingerprint xtables match") Reported-by: Kito Xu (veritas501) Closes: https://lore.kernel.org/netfilter-devel/20260414074556.2512750-1-hxzene@gmail.com/ Signed-off-by: Fernando Fernandez Mancera Reviewed-by: Pablo Neira Ayuso Signed-off-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin --- net/netfilter/nfnetlink_osf.c | 22 +++++++--------------- 1 file changed, 7 insertions(+), 15 deletions(-) diff --git a/net/netfilter/nfnetlink_osf.c b/net/netfilter/nfnetlink_osf.c index 2207bda442d54..6d3dfbeb398cb 100644 --- a/net/netfilter/nfnetlink_osf.c +++ b/net/netfilter/nfnetlink_osf.c @@ -31,26 +31,18 @@ EXPORT_SYMBOL_GPL(nf_osf_fingers); static inline int nf_osf_ttl(const struct sk_buff *skb, int ttl_check, unsigned char f_ttl) { - struct in_device *in_dev = __in_dev_get_rcu(skb->dev); const struct iphdr *ip = ip_hdr(skb); - const struct in_ifaddr *ifa; - int ret = 0; - if (ttl_check == NF_OSF_TTL_TRUE) + switch (ttl_check) { + case NF_OSF_TTL_TRUE: return ip->ttl == f_ttl; - if (ttl_check == NF_OSF_TTL_NOCHECK) - return 1; - else if (ip->ttl <= f_ttl) + break; + case NF_OSF_TTL_NOCHECK: return 1; - - in_dev_for_each_ifa_rcu(ifa, in_dev) { - if (inet_ifa_match(ip->saddr, ifa)) { - ret = (ip->ttl == f_ttl); - break; - } + case NF_OSF_TTL_LESS: + default: + return ip->ttl <= f_ttl; } - - return ret; } struct nf_osf_hdr_ctx { -- 2.53.0