Commit 7227e11e authored by Maxim Mikityanskiy's avatar Maxim Mikityanskiy Committed by Yang Yingliang
Browse files

netfilter: synproxy: Fix out of bounds when parsing TCP options 



stable inclusion
from linux-4.19.196
commit 7d9a9a1a88a3da574e019b4de756bc73337b3b0b

--------------------------------

[ Upstream commit 5fc177ab ]

The TCP option parser in synproxy (synproxy_parse_options) could read
one byte out of bounds. When the length is 1, the execution flow gets
into the loop, reads one byte of the opcode, and if the opcode is
neither TCPOPT_EOL nor TCPOPT_NOP, it reads one more byte, which exceeds
the length of 1.

This fix is inspired by commit 9609dad2 ("ipv4: tcp_input: fix stack
out of bounds when parsing TCP options.").

v2 changes:

Added an early return when length < 0 to avoid calling
skb_header_pointer with negative length.

Cc: Young Xiao <92siuyang@gmail.com>
Fixes: 48b1de4c ("netfilter: add SYNPROXY core/target")
Signed-off-by: default avatarMaxim Mikityanskiy <maximmi@nvidia.com>
Reviewed-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parent 53dccae7

net/netfilter/nf_synproxy_core.c

+5 −0
Original line number Diff line number Diff line
@@ -34,6 +34,9 @@ synproxy_parse_options(const struct sk_buff *skb, unsigned int doff, 
	int length = (th->doff * 4) - sizeof(*th);

	u8 buf[40], *ptr;



	if (unlikely(length < 0))

		return false;



	ptr = skb_header_pointer(skb, doff + sizeof(*th), length, buf);

	if (ptr == NULL)

		return false;
@@ -50,6 +53,8 @@ synproxy_parse_options(const struct sk_buff *skb, unsigned int doff, 
			length--;

			continue;

		default:

			if (length < 2)

				return true;

			opsize = *ptr++;

			if (opsize < 2)

				return true;