From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C4DE6349AFF; Wed, 20 May 2026 17:46:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779299220; cv=none; b=iXW2OCQfUUuF94dpyHSQsW+eHOHa2B3QlHzqz71LImELSg+vvGkiynXt7DWtmYVV+YGFOWnhsrJG/KqXcjru/fsRRcldGu4c/agRkpnbHxOxbeEVbR9L8/13M8bhwQ2ffIGLyK1eiFu9Y7BFIEwc5YX6VsNn+Y9u/IOCfTsaRgo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779299220; c=relaxed/simple; bh=XfsMAr+Iu4Hf0hy33iICTEwPr6lPOOvhpnpvnTNDmxU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=YNpZ5luNaxriLRu+crAkwZ/izPPRCBbDzYNM6sSdZi7LIRiXtOiQEGpMx/dEbyQmnrCWFUQb23zSH4D1dkRwNXy/nXltRTtyLKCKrBVZJpHcVgpCvr3joaxXorl6tXMn7Venz3FI3990Wyhjf/xQLbchHF32Hz2TkfFygLxJ9XI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=lpckpqkc; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="lpckpqkc" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3581F1F000E9; Wed, 20 May 2026 17:46:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1779299219; bh=kGE1tWX+5r7UKjuKrCOlplxaeEoNf9EM9D9+nsSXgxM=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=lpckpqkczNhQ305HqgvofHyHsPSlqWblVrXCDfWzP88LujqFx4/zXloGT8/KhMcbx qwKQgVeXetMksjSgKoKYZKpSBTGl+6gFW2VZOku1wOmS0IseT/PASBMIBLDiMdrhPi xmEni2quZAp6w7n0YECua+fu6mIMfvQ6cLCcPWsQ= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, "Kito Xu (veritas501)" , Fernando Fernandez Mancera , Pablo Neira Ayuso , Sasha Levin Subject: [PATCH 6.18 667/957] netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check Date: Wed, 20 May 2026 18:19:10 +0200 Message-ID: <20260520162148.997965689@linuxfoundation.org> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260520162134.554764788@linuxfoundation.org> References: <20260520162134.554764788@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Fernando Fernandez Mancera [ Upstream commit 711987ba281fd806322a7cd244e98e2a81903114 ] The nf_osf_ttl() function accessed skb->dev to perform a local interface address lookup without verifying that the device pointer was valid. Additionally, the implementation utilized an in_dev_for_each_ifa_rcu loop to match the packet source address against local interface addresses. It assumed that packets from the same subnet should not see a decrement on the initial TTL. A packet might appear it is from the same subnet but it actually isn't especially in modern environments with containers and virtual switching. Remove the device dereference and interface loop. Replace the logic with a switch statement that evaluates the TTL according to the ttl_check. Fixes: 11eeef41d5f6 ("netfilter: passive OS fingerprint xtables match") Reported-by: Kito Xu (veritas501) Closes: https://lore.kernel.org/netfilter-devel/20260414074556.2512750-1-hxzene@gmail.com/ Signed-off-by: Fernando Fernandez Mancera Reviewed-by: Pablo Neira Ayuso Signed-off-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin --- net/netfilter/nfnetlink_osf.c | 22 +++++++--------------- 1 file changed, 7 insertions(+), 15 deletions(-) diff --git a/net/netfilter/nfnetlink_osf.c b/net/netfilter/nfnetlink_osf.c index 832a973c41777..c89efb951994a 100644 --- a/net/netfilter/nfnetlink_osf.c +++ b/net/netfilter/nfnetlink_osf.c @@ -31,26 +31,18 @@ EXPORT_SYMBOL_GPL(nf_osf_fingers); static inline int nf_osf_ttl(const struct sk_buff *skb, int ttl_check, unsigned char f_ttl) { - struct in_device *in_dev = __in_dev_get_rcu(skb->dev); const struct iphdr *ip = ip_hdr(skb); - const struct in_ifaddr *ifa; - int ret = 0; - if (ttl_check == NF_OSF_TTL_TRUE) + switch (ttl_check) { + case NF_OSF_TTL_TRUE: return ip->ttl == f_ttl; - if (ttl_check == NF_OSF_TTL_NOCHECK) - return 1; - else if (ip->ttl <= f_ttl) + break; + case NF_OSF_TTL_NOCHECK: return 1; - - in_dev_for_each_ifa_rcu(ifa, in_dev) { - if (inet_ifa_match(ip->saddr, ifa)) { - ret = (ip->ttl == f_ttl); - break; - } + case NF_OSF_TTL_LESS: + default: + return ip->ttl <= f_ttl; } - - return ret; } struct nf_osf_hdr_ctx { -- 2.53.0