Commit 559c36c5 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso Committed by Florian Westphal
Browse files

netfilter: nfnetlink_osf: fix possible bogus match in nf_osf_find() 



nf_osf_find() incorrectly returns true on mismatch, this leads to
copying uninitialized memory area in nft_osf which can be used to leak
stale kernel stack data to userspace.

Fixes: 22c7652c ("netfilter: nft_osf: Add version option support")
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
parent e8d5dfd1

net/netfilter/nfnetlink_osf.c

+3 −1
Original line number Diff line number Diff line
@@ -269,6 +269,7 @@ bool nf_osf_find(const struct sk_buff *skb, 
	struct nf_osf_hdr_ctx ctx;

	const struct tcphdr *tcp;

	struct tcphdr _tcph;

	bool found = false;



	memset(&ctx, 0, sizeof(ctx));
@@ -283,10 +284,11 @@ bool nf_osf_find(const struct sk_buff *skb, 


		data->genre = f->genre;

		data->version = f->version;

		found = true;

		break;

	}



	return true;

	return found;

}

EXPORT_SYMBOL_GPL(nf_osf_find);