Commit 6018a266 authored by Zhengchao Shao's avatar Zhengchao Shao Committed by Steffen Klassert
Browse files

ip_vti: fix potential slab-use-after-free in decode_session6 



When ip_vti device is set to the qdisc of the sfb type, the cb field
of the sent skb may be modified during enqueuing. Then,
slab-use-after-free may occur when ip_vti device sends IPv6 packets.
As commit f8556919 ("xfrm6: Fix the nexthdr offset in
_decode_session6.") showed, xfrm_decode_session was originally intended
only for the receive path. IP6CB(skb)->nhoff is not set during
transmission. Therefore, set the cb field in the skb to 0 before
sending packets.

Fixes: f8556919 ("xfrm6: Fix the nexthdr offset in _decode_session6.")
Signed-off-by: default avatarZhengchao Shao <shaozhengchao@huawei.com>
Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
parent 9fd41f1b

net/ipv4/ip_vti.c

+2 −2
Original line number Diff line number Diff line
@@ -287,12 +287,12 @@ static netdev_tx_t vti_tunnel_xmit(struct sk_buff *skb, struct net_device *dev) 


	switch (skb->protocol) {

	case htons(ETH_P_IP):

		xfrm_decode_session(skb, &fl, AF_INET);

		memset(IPCB(skb), 0, sizeof(*IPCB(skb)));

		xfrm_decode_session(skb, &fl, AF_INET);

		break;

	case htons(ETH_P_IPV6):

		xfrm_decode_session(skb, &fl, AF_INET6);

		memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));

		xfrm_decode_session(skb, &fl, AF_INET6);

		break;

	default:

		goto tx_err;