Skip to content

Commit b22f512

Browse files
Daniel Borkmannummakynes
Daniel Borkmann
authored andcommitted
netfilter: nf_conntrack_dccp: fix skb_header_pointer API usages
Some occurences in the netfilter tree use skb_header_pointer() in the following way ... struct dccp_hdr _dh, *dh; ... skb_header_pointer(skb, dataoff, sizeof(_dh), &dh); ... where dh itself is a pointer that is being passed as the copy buffer. Instead, we need to use &_dh as the forth argument so that we're copying the data into an actual buffer that sits on the stack. Currently, we probably could overwrite memory on the stack (e.g. with a possibly mal-formed DCCP packet), but unintentionally, as we only want the buffer to be placed into _dh variable. Fixes: 2bc7804 ("[NETFILTER]: nf_conntrack: add DCCP protocol support") Signed-off-by: Daniel Borkmann <dborkman@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
1 parent 138aef7 commit b22f512

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

Diff for: net/netfilter/nf_conntrack_proto_dccp.c

+3-3
Original file line numberDiff line numberDiff line change
@@ -428,7 +428,7 @@ static bool dccp_new(struct nf_conn *ct, const struct sk_buff *skb,
428428
const char *msg;
429429
u_int8_t state;
430430

431-
dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &dh);
431+
dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &_dh);
432432
BUG_ON(dh == NULL);
433433

434434
state = dccp_state_table[CT_DCCP_ROLE_CLIENT][dh->dccph_type][CT_DCCP_NONE];
@@ -486,7 +486,7 @@ static int dccp_packet(struct nf_conn *ct, const struct sk_buff *skb,
486486
u_int8_t type, old_state, new_state;
487487
enum ct_dccp_roles role;
488488

489-
dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &dh);
489+
dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &_dh);
490490
BUG_ON(dh == NULL);
491491
type = dh->dccph_type;
492492

@@ -577,7 +577,7 @@ static int dccp_error(struct net *net, struct nf_conn *tmpl,
577577
unsigned int cscov;
578578
const char *msg;
579579

580-
dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &dh);
580+
dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &_dh);
581581
if (dh == NULL) {
582582
msg = "nf_ct_dccp: short packet ";
583583
goto out_invalid;

0 commit comments

Comments
 (0)