Commit 53a5b4f2 authored by Steffen Klassert's avatar Steffen Klassert
Browse files

xfrm Fix use after free in __xfrm6_udp_encap_rcv. 



A recent patch changed xfrm6_udp_encap_rcv to not
free the skb itself anymore but fogot the case
where xfrm4_udp_encap_rcv is called subsequently.

Fix this by moving the call to xfrm4_udp_encap_rcv
from __xfrm6_udp_encap_rcv to xfrm6_udp_encap_rcv.

Fixes: 221ddb72 ("xfrm: Support GRO for IPv6 ESP in UDP encapsulation")
Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
parent efedce33

net/ipv4/xfrm4_input.c

+2 −1
Original line number Diff line number Diff line
@@ -159,7 +159,6 @@ static int __xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb, bool pull 
	/* process ESP */

	return 0;

}

EXPORT_SYMBOL(xfrm4_udp_encap_rcv);



/* If it's a keepalive packet, then just eat it.

 * If it's an encapsulated packet, then pass it to the
@@ -184,6 +183,7 @@ int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb) 


	return ret;

}

EXPORT_SYMBOL(xfrm4_udp_encap_rcv);



struct sk_buff *xfrm4_gro_udp_encap_rcv(struct sock *sk, struct list_head *head,

					struct sk_buff *skb)
@@ -223,6 +223,7 @@ struct sk_buff *xfrm4_gro_udp_encap_rcv(struct sock *sk, struct list_head *head, 


	return NULL;

}

EXPORT_SYMBOL(xfrm4_gro_udp_encap_rcv);



int xfrm4_rcv(struct sk_buff *skb)

{

net/ipv6/xfrm6_input.c

+6 −3
Original line number Diff line number Diff line
@@ -80,9 +80,6 @@ static int __xfrm6_udp_encap_rcv(struct sock *sk, struct sk_buff *skb, bool pull 
	__be32 *udpdata32;

	u16 encap_type;



	if (skb->protocol == htons(ETH_P_IP))

		return xfrm4_udp_encap_rcv(sk, skb);



	encap_type = READ_ONCE(up->encap_type);

	/* if this is not encapsulated socket, then just return now */

	if (!encap_type)
@@ -169,6 +166,9 @@ int xfrm6_udp_encap_rcv(struct sock *sk, struct sk_buff *skb) 
{

	int ret;



	if (skb->protocol == htons(ETH_P_IP))

		return xfrm4_udp_encap_rcv(sk, skb);



	ret = __xfrm6_udp_encap_rcv(sk, skb, true);

	if (!ret)

		return xfrm6_rcv_encap(skb, IPPROTO_ESP, 0,
@@ -190,6 +190,9 @@ struct sk_buff *xfrm6_gro_udp_encap_rcv(struct sock *sk, struct list_head *head, 
	struct sk_buff *pp = NULL;

	int ret;



	if (skb->protocol == htons(ETH_P_IP))

		return xfrm4_gro_udp_encap_rcv(sk, head, skb);



	offset = offset - sizeof(struct udphdr);



	if (!pskb_pull(skb, offset))